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Windows 2000 and the Web: Microsoft Prepares an XML-Enabled 
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... based on the full XML 1.0 specification. Now an application can 

drop a dataset off transact ionally and guarantee delivery after doing all 
logging, tracking, auditing and data transforms natively. 

BizTalk tools. Three desktop applications provide interfaces for 
working with the BizTalk Server. They include BizDesk for managing accounts 
and Editor and Mapper applications for writing rules and matching 
document type definitions to database schemas. 

BizDesk provides tools for setting up and managing trading partner 
accounts. To facilitate the exchange of business documents, trading 
partners expose profile properties, including organization contact names 
and identifiers; transmit encryption and protocol data; document 
interchange definitions; and document schema, certificate and signature 
information. Each partner submits an XML proposal document, that, when 
accepted, becomes an agreement about... 
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... operating systems to provide. Security, particularly important in 

the corporate environment, is maturing as wide area networking and 
internetworking become a part of the enterprise. Data administration 

(tracking, auditing , and organized access to information stores) is 
maturing as well. 

As they gear up to compete in the emerging market, messaging vendors 
are focusing on the following concerns: 
Downsi zing--As . . . 

...services to new platforms. 

Compat ibility/Ubiquity--Integration with the existing infrastructure 
is another critical requirement. During the past four years, several 
proprietary standards for messaging protocols have emerged, notably 
Microsoft's MAPI {Messaging Application Programming Interface), Lotus's 
VIM (Vendor Independent Messaging), and Novell's MHS (Messaging Handling 
Service). Since large enterprises are likely to support more... 



11/3, K/3 (Item 3 from file: 275) 

DIALOG (R) File 275:Gale Group Computer DB(TM) 
(c) 2004 The Gale Group. All rts. reserv. 

01 464030 SUPPLIER NUMBER: 11627404 (USE FORMAT 7 OR 9 FOR FULL TEXT) 
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NDM provides data transfer, detailed audit statistics of transfer 
activity, and automated activity between transfers and related 
applications. The product supports other protocols including LU 0, LU 1, 
LU 2, X.25 and NETEX . 

Systems Center is located at 1800 Alexander Bell Dr., Reston, Va . 
22091; (703) 264. . . 
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. . . announced it has commissioned a team consisting of KPMG and 

environmental consultants, URS Corporation to independently verify Texaco' 
Greenhouse Gas Emission (GHG) inventories and protocol . 

Upon completion of the audit, the team will publish their opinion 
statement making Texaco among the first U.S. -based international oil and 
gas ma j or . . . 

...for the years 1997 through 1999. 

Phase one of this two-phase project will systematically review and 
critique the quality of Texaco' s emissions inventory protocol , its 
associated estimation and reporting processes, and underlying data 
sources. Phase two will consist of audit process development, site 
selection and site visits for inventory verification. Both... 

...climate change and believes that enough is known about it to warrant 
action now," said Elliott P. Laws, Texaco Safety Health and Environment 
President. "Independently auditing our greenhouse gas emissions data i 
just one way that Texaco is actively addressing the issue of climate 
change. Other activities include effective emissions management, 
participation in leading research collaborations,.. 
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. . . initial launch phase will be on establishing a diverse and 

respected customer base that will provide added value to Nanogen 's product 
launch by developing protocols , acting as reference sites, publishing 
studies or speaking at conferences. We have assembled an enviable list of 
leading research institutions as part of this program. 
"While we remain. . . 



. . . the basis for these e^^mates to be accurate but the p^^Biminary 

financial results are sur^sct to adjustment based on revi^by the 
Company's independent auditors . Nanogen will release final financial 
results and will host a conference call for investors and analysts on 
January 31, 2001. Further information regarding the investor and analyst 
conference call will be... 
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. . . gain control over these complex environments and guarantee optimal 

service to their customers." 

-- EXPERIENCE RULES FREE MANAGEMENT - PRISM immediately detects 
service outages without establishing event correlation rule sets. This 
improves time to operation and eliminates the hassle of defining complex 
relations for large multi-vendor environments. 

-- IMPROVE CUSTOMER SERVICE - PRISM enables service... 

...identified and isolated and proactively resolved before they affect 
service availability. 

SUPPORT NEXT GENERATION DEVICES - PRISM supports new Internet 
quality of service technologies and routing protocols , in addition to 
next generation broadband and optical transmission equipment necessary to 
deliver converged voice, video, and data services. 

-- AUDIT CONFIGURATIONS - PRISM protects the business by 
automatically detecting misconf igured devices and non-optimal routing 
paths. Aprisma ' s new technology intelligently identifies configuration 
e r rors cha t may . . . 
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. . . 600 page validation summary document in Microsoft Word. Additional 

information included with this kit are InnaPhase corporate information, 
software development methodology used, electronic test and reference data 
files, full testing protocol and templates, and installation checklist 
templates . 

"The Validation Agent can be run as many times as required and 
provides automated, fast and reliable installation testing... 

...year to release a further QA toolset as part of their new enterprise 
PK/PD system, EP1 . This integrated QA toolset includes the Validation 
Agent, Data Trace and Audit Agent modules. 

Data Trace offers internal and external auditors the ability to 



create automatic and com^^Phensive quality assurance repc^^p that address 
al\ aspects of data trac^^bility . The Study Reconciliatic^r Report contains 
a list . . . 
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... Stephen R. Zimmer, head of Arthur Andersen's Defense 

Computer Integrated Manufacturing (CIM) practice. 

"Intel's commitment to standards, like the MULTIBUS (TM) architecture 
and MAP (Manufacturing Automation Protocol ) allows us to provide a 
cost-effective cell controller that has a high degree of flexibility 
and performance," explained Zimmer. "This controller will meet all... 

...300-based work cell controller specifically tailored to the 
requirements of the aerospace industry." 

Arthur Andersen's worldwide organization provides professional 
services in accounting and audit , tax, management information 
consulting and professional education to clients through 200 offices 
in 50 countries. With more than 9,000 personnel in its CIM practice, 
Arthur Andersen offers... 
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The "AuditPro" protocols reference U.S. EHS requirements and 
contain checklists, inspection forms and flow diagrams to help auditors 
gather data to measure performance. The program—consisting of 22 
state-of-the-art EHS protocols on both paper and disk versions— also 
outlines a process to examine management systems and emerging international 
standards . 

For more information, call (617) 498-5000... 
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EDI NEWS round-i^Winds . 

Among the Internet ^Rvices offered or in the works : Trccess to VAN 
services via the Internet's TCP/IP communications protocol ; Internet 
Mail, including support for the MIME protocol designed to carry EDI and 
related multimedia files within the same message envelope; and World Wide 
Web sites for obtaining information and technical assistance. 

That VANs are warming to the Internet... 

...day is a long way off when a significant portion of EDI traffic will 
travel the global network. End-users want security, reliability, non- 
repudiation, audit trails, authentication, data integrity and 
consulting, among other services. Whether the Internet can offer these 
remains a question mark, VANs say. In addition, any price advantage now 
enjoyed. . . 
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... the GLP inspection and enforcement program {i.e., impairment of the 

agency's inspection targeting ability or the efficiency of the GLP 
compliance inspections or data audits , etc.)." Examples included: 

failure to notify a person performing under contract of the 
applicability of GLPs . -- failure to keep personnel records, 
--falsification of personnel records... 

. . . management . 

-- failure to isolate all newly received animals from outside sources 
until their health status has been evaluated. — failure to characterize 
the test, control or reference substances. 

failure to have a protocol . — deviation from the protocol 
without documentation and/or study director written signoff. — failure to 
record raw data. -- falsification of raw data. -- failure to retain raw 
data and specimens. 

A. . . 
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... it potential applications throughout the Defense Dept. 

System handles all levels of security 

Unisys program manager Lorraine Martin said the network is built upon 
"standard protocols and open systems, " yet handles all levels of 
security. The same concept can be applied for the commercial sector for 
safeguarding data. 

The system represents... 

...tools, Unisys said. It described the tools as the: 

- Network Security Server (NSS) . The central point for network 



security management incl^^wng operator and subscriber acc^B, data 
management and security ^audit data collection and analysis . 

- Network Control Center (NCC) . Provides network management via a 
simple network management protocol . Functions include a network topology 
map , a configuration management tool, and a status monitoring tool. 

The NCC and NSS work with identical Sun Microsystem 3/470 server 
systems--each with 16. . . 
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... applications throughout the Defense Department." 

Extensive use of commercial parts opens new vistas 

Unisys program manager Lorraine Martin said the network is built upon 
"standard protocols and open systems, " yet handles all levels of 
security. The same concept can be applied to the commercial sector for 
safeguarding data. 

The system represents... 

...backbone network and two management tools. Those tools include: 

- Network Security Server (NSS) . The central point for network 
security management including operator and subscriber access, data 
management and security audit data collection and analysis. 

- Network Control Center (NCC) . Provides network management via a 
simple network management protocol . Functions include a ' network topology 
map , a configuration management tool, a status monitoring tool and a means 
of actual monitoring. 

The NCC and NSS work with identical Sun Microsystems 3/470... 
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... portion of the ear. The GAB method can be frequency-specific and 

can measure the integrity of the cochlea regardless of the integrity of the 

auditory nerve, though results may be sensitive to minor conductive 
conditions such as birth debris in the external ear canal. The ABR method 
may be less sensitive to minor... 

...disadvantages. A two-stage process also can be implemented even if the 
same method is used for both stages, essentially a single re-screening. 
Either protocol can reduce the refer rate in normal ears (false 
positive results). 

Neither test is 100% accurate or 100% reliable so a two-stage 
process reduces the effect of errors... 
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... includes NetSuite Professional Audit 3.0, for detecting the network 

topology; NetSuite Advanced Professional Design 3.0, which provides a 
design schematic to hold the data discovered by the auditing engine; 
NetSuite Toolkit 3.0, a set of tools to customize network design; and an 
expanded version of the NetSuite Library that can be used. . . 

...provide detailed information about the device's operating system, as 
well as installed cards and attached PCs. 

NetSuite Advanced Professional Design 3.0 recognizes network 
protocols , assigns properties associated with them, and validates 
network addresses. For example, a network planner can assign IP addresses 
to certain ports of a switch so that the network... 
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. . . implementation with Triple DES strength and verified via packet 

sniffer that VPNet had implemented the Authentication header and 
Encapsulating Security Payload features of the current protocol . 

Sessions are dynamically rekeyed at 30-second intervals via the Secure 
Key Internet Protocol , or SKIP. This is the only real difference between 
VPNet ' s technology and the current state of the IPSec standard that will 
likely recommend a variation of Internet Security Association and Key 
Management Protocol /Oakley for session-key management. We felt confident 
that these security provisions, combined with extensive authentication 
mechanisms and a packet-level security auditing tool, were keeping our 
data safe as it traversed the Internet. 

True to its claim of hardware-speed cryptography, VPNet was the 
fastest overall performer of the encrypting solutions. Interestingly... 
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constituency. 
Canada Revenue Commission 



We shall be pleas^^Bs hear a brief update and procj^^k report on the 
activities of the Canada avenue Commission. 
Audit Protocol 

Commencing with the 1996 liaison meeting and throughout the ensuing 
year, there have been a number of discussions between representatives of 
Revenue Canada and business taxpayers concerning the Department's audit 
protocol initiative. As a part of the consultation process, the Institute 
submitted formal written comments on the Draft Audit Protocol 
Reference Manual {hereinafter "the protocol " ) on September 27, 1996. In 
order to advance the consultation process and elaborate on the issues 
raised in our written submission, we invite Revenue Canada's comments 
-x.ncerning the following: 

1. The protocol sets forth a framework for managing the audit 
process on a prospective basis. The speed with. which taxpayers and Tax 
Services Office Auditors alike embrace the cooperative approach envisioned 
in the protocol , however, may depend upon the resolution of significant, 
pending audit issues in open taxation years. Has Revenue Canada developed 
any measures to expedite the resolution of pending audit issues and cases 
before, or in connection with, the implementation of the audit protocol ? 
For example, the backlog of taxpayer Scientific Research and Experimental 
Development (SR&ED) claims is significant in scope and magnitude. Is 
expedited review of these claims envisioned? Are there additional 
"back-year" issues that may impede the transition to an audit framework 
governed by the protocol ? 

2. One underlying purpose of the protocol is to engender greater 
openness and trust between Revenue Canada and taxpayers. That trust may be 
undermined where significant decisions affecting the disposition of the... 
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... s side, government revenues are not collected in a timely fashion 

and the inventory of open tax years mounts. TEI appreciates both the 
opportunity to comment on the proposals for an audit framework for 
large-file corporations and the government's implicit recognition that 
large-file taxpayers have such a significant stake in the tax compliance 
process . . . 

...the format of its earlier proposals. Notwithstanding the good faith 
nature in which the initial drafts were conceived, taxpayers viewed some 
aspects of the audit protocol framework as intrusive, one-sided in favor 
of the government, and counter-productive to the goals of increasing the 
efficiency and currency of audits. Moreover... 

...the framework to address taxpayer concerns as they arise. In other 
words, a mechanism should be developed, and timetable established, to 
review whether the audit protocol framework in the Reference Manual and 
the manner of its implementation "make sense" in light of changes in the 
tax law, availability of resources, and improvements in audit and 
management practices. Audit protocols , in our view, are evolutionary 
tools that must adapt to their environment. 
Managing the Audit Process 

TEI believes that effective, timely, and efficient audits depend. . . 
there are good or best practices that have withstood the test of time, the 
proposed document will be greatly improved and assure taxpayers that the 
protocols will not diminish protections otherwise accorded to them by law 
or customary audit practice. 

Examples of statements that should be included: 

* No changes in administrative... 



..^ timely basis. 

Design, Implementation, and 

/Administration of Protocols 

Absence of a Protocol or Revocation of Existing Protocol. Question 
cind Answer 11 of the Draft Audit Protocol Reference Manual states that 
a protocol may be revoked because it is not a legally binding agreement. 
We agree that an audit protocol is an exhortative statement of goals and 
obj ect ives . . . 

...of the audit inquiries, the procedures employed, or the number of 
transactions or entities examined. In other words, a taxpayer who refuses 
to enter a protocol (or revokes an existing agreement) should not be 
subject to more rigorous procedures or more onerous requests for 
documentation than other taxpayers of similar size.., 

...that a Question and Answer be added to the Reference Manual to clarify 
that no negative inference will be drawn from and no more burdensome audit 

will be conducted as a result of a taxpayer's declining to enter into a 
protocol or revoking an existing agreement. 

Administration of Protocols .• During the course of nearly every 
audit, circumstances arise that are entirely outside the control of either 
the taxpayer or the government. In administering the protocols , the 
commitments undertaken in the protocol should be viewed as flexible goals 
and objectives rather than rigid checklists. The importance of flexibility 
in the design, implementation, and administration of the agreements in 
particular audit cases should be stressed in the Reference Manual. We 
recommend that a statement be added that emphasizes this. 

Design and Implementation of Protocols . Clearly, the individual 
protocol documents must be tailored to take account of each taxpayer's 
industry-specific issues, the facts and circumstances of the taxpayer's tax 
history and attributes, and its accounting and information system. The 
Reference Manual's outline of a protocol agreement must be viewed as a 
flexible model rather than as a prescribed one-size-fits-all agreement. 
Indeed, we believe it is critical that the audit protocol explicitly 
acknowledge this. Based on Question and Answer 5 of the Reference Manual, 
our recommendation is likely consistent with Revenue Canada's intent. 
Nonetheless, Revenue. . . 




11/3, K/19 (Item 4 from file: 148) 

DIALOG (R) File 148: Gale Group Trade & Industry DB 
{c)2004 The Gale Group. All rts. reserv. 

08282215 SUPPLIER NUMBER: 17463518 (USE FORMAT 7 OR 9 FOR FULL TEXT) 

Necropsy as a research method in the age of molecular pathology. (Review 
Article) 

Kleiner, David E.; Emmert-Buck, Michael R.; Liotta, Lance A. 
Lancet, v346, n8980 / p945(4) 
Oct 7, 1995 

ISSN: 0099-5355 LANGUAGE: English RECORD TYPE: Fulltext; Abstract 

WORD COUNT: 3418 LINE COUNT: 00275 

TEXT: 

. ..Bethesda, Maryland, has experienced a great decline in the number 
of necropsies done since 1980 (figure 1), despite all our patients being 
followed on research protocols . Necropsies not only provide physicians 
with information on the status of a patient's disease at death, but can 
also provide findings that might influence the protocol , as well as 
serving as a tissue source for protocol - related research. Most of the 
studies cited above have focused on the use of the necropsy as a 
quality-assurance tool that provides information on the... 

...about the continued value of post-mortem examinations. In reported 
necropsy audits done over the past 80 years, as well as in our own internal 

audit , the rate of these significant findings has remained constant, 
varying between 10% and 30% . 6 Thus the necropsy retains its role as a 
method to provide physicians and hospitals with information... 



ll/3,K/20 (Item 5 from file: 148) 

DIALOG (R) File 148: Gale Group Trade & Industry DB 
(c)2004 The Gale Group. All rts. reserv. 

07608087 SUPPLIER NUMBER: 16530102 (USE FORMAT 7 OR 9 FOR FULL TEXT) 

Put security to the test. (Security Audits) 
Kohr, Robert L. 

Security Management, v38, nl2, p64(5) 
Dec, 1994 

ISSN: 0145-9406 LANGUAGE: ENGLISH RECORD TYPE: FULLTEXT; ABSTRACT 

WORD COUNT: 2056 LINE COUNT: 00166 

resource allocation by identifying risks and defining gaps in 
programs, responsibilities, tools, funds, and costs. Available funds can 
then be targeted toward the greatest risks. Audit results may also be 
compared with the performance of competitors for benchmarking purposes. 

How to audit. Traditionally, auditing has involved three major 
activities--the preaudit, the... 

...audit team and team leader, and development of an audit plan. 

Drawing up an audit plan includes defining the scope, selecting 
priority topics, modifying audit protocols , and allocating team 
resources. Once the audit team arrives at the site, an opening briefing 
should be held with management to discuss the scope and steps that evaluate 
risk and compliance management processes at the facility and focus on 
programs. The four steps correlate to the TQM process. 

Audit protocols are developed that use the four steps to assist the 
auditors in properly assessing the security and safety management programs. 

Protocols are designed to be topical outlines that ask open-ended 
questions about the topic being audited. In addition, they organize audit 
procedures into sequential steps... 



11/3, K/21 (Item 6 from file: 148) 

DIALOG (R) File 148:Gale Group Trade & Industry DB 
(c)2004 The Gale Group. All rts. reserv. 

04850784 SUPPLIER NUMBER: 08935068 {USE FORMAT 7 OR 9 FOR FULL TEXT) 

Using charge protocols to document clinical activities. (Patient Accounts 
Management) 

Rode, Dan 

Healthcare Financial Management, v44, nlO, p82(2) 
Oct, 1990 

ISSN: 0735-0732 LANGUAGE: ENGLISH RECORD TYPE: FULLTEXT 

WORD COUNT: 1075 LINE COUNT: 00089 

... to have a clinical or medical staff member or an electronic system 

record all service elements, each time they occur, in the medical record. 

Charge protocols . To overcome the documentation process, many 
facilities have developed " protocols ' to substantiate items or charges 
associated with a particular service. 

In this case, protocol should be distinguished from a batch of 
services automatically performed at some time in the patient's course of 
diagnosis or treatment. In the past, admission protocols called for 
conducting a blanket set of diagnostic procedures on each patient at the 
time of admission, no matter what the patient's condition. Most payers have 
prohibited payment for these protocols , and most providers no longer 
perform them. 

Charge or service protocols should be dearly established by members 
of the clinical or medical staff, with the help of qualified patient 
accounting staff members who understand third-party requirements. The 
protocols should be specific about charges or elements associated with a 
service activity and should cover charges or elements that are optional 
versus those deemed consistent. 

Both departments should keep a record or reference on established 
protocols . They also should review protocols when a service activity 



changes and on a periodi^^Basis . 

Hundreds of protocW.s could exist within a healthcare 
organization-and management must decide how to attack the monster. The 
effort win be facilitated or hampered by the number of protocols that 
already exist in a provider's clinical and ancillary areas. A provider 
should identify a process for evaluation, staffing required to facilitate a 
review, and the effort involved in keeping a system up-to-date with changes 
in technology and practice. Developing protocols 

Because reviewing existing processes or practices involves 
significant effort, a healthcare provider must weigh relevant merits 
against exposure to negative audit results . Whatever the risks, patient 
accounts managers should ensure their departments' involvement in 
establishing new charges. Involving patient accounting staff members allows 
a hospital to identify a new charge and any services or other charges 
involved in setting new protocols . 

Patient accounting staff members also should be involved in 
establishing charges, permitting identification of necessary procedural 
coding to facilitate billing, auditing, and perhaps cost accounting... 
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... this DNC networking requirement. NCNet downloads part programs, 

cool offsets and setup sheets, communicates with production equipment on 
the factory floor, and uploads completed job data for monitoring and 
auditing by management. 

NCNet networks with Prime's "Medusa* software, its core CAD platform, 
and with Prime "Information, ' its core software platform for MRP II 
(manufacturing. . . 

...goal, companies would have nearly unlimited manufacturing flexibility to 
react to market demands and change designs. 

According to Boes, Prime supports both the Manufacturing Automation 
Protocol ( MAP ) and the Technical Office Protocol (TOP) , and is 
currently developing a MAP/TOP compatible local area network (LAN) . Prime 
currently offers its proprietary "PrimeNet* LAN to customers, which is not 
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TEXT: SUMMARY 

This paper reports the results of a verbal protocol study designed to 
assess how variation in inherent-risk factors affects auditors 1 decision 
processes throughout audit planning, including the tasks of risk 
assessment, generation of... 

...results highlight the importance of identifying and communicating client 



risk factors to all audJ^^peam members in the planning s 

Key Words: Auditing, Analytical procedures, Audit planning, Hypothesis 
generation . 

Data Availability: Verbal protocols from this study are available from 
the authors upon request. 

The purpose of this study is to explore how differences in client 
inherent-risk factors affect auditors' decision processes across several 
inter- related audit-planning tasks. Using verbal protocol analysis, we 
examine how audit plans are developed and justified, and whether 
differences in decision processes are associated with variation in client 
risk factors. This... 
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...TEXT: includes NetSuite Professional Audit 3.0, for detecting the 
network topology; NetSuite Advanced Professional Design 3.0, which provides 
a design schematic to hold the data discovered by the auditing engine; 
NetSuite Toolkit 3.0, a set of tools to customize network design; and an 
expanded version of the NetSuite Library that can be used... 

... provide detailed information about the device's operating system, as 
well as installed cards and attached PCs. 

NetSuite Advanced Professional Design 3.0 recognizes network protocols , 
assigns properties associated with them, and validates network addresses. 
For example, a network planner can assign IP addresses to certain ports of 
a switch so that the network. . . 
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...TEXT: linkage between patterns of information, intermediate subgoal 
conclusions (see figure 2), and a loan collectibility judgment. Other 
experienced auditors may reason differently. Use of verbal protocol 
analysis (e.g. , 

Biggs and Mock 1983) would provide process data for determining the 
generality of the model. Additional ways of studying loan judgment 
processes . . . 

...how this analysis might be conducted. 

The relative importance of information cues also merits further research. 
The declarative and procedural knowledge manifested in the production 
rules implies the relative importance of information cues for 
determination of subgoal (and loan) conclusions. The extent to which values 



of a cue lead to dif f er^^Psubgoal conclusions (holding..' 



... e.g., Libby 1976) and this would complicate any analysis of the impact 
of a single cue. The model's results may be compared with results from 
other experienced financial institution auditors , perhaps using other 
judgment research methodologies for assessing cue importance. 

Footnote : 

Helpful comments on this research were provided by Andy Bailey, Jim Peters 
ri uci John . . . 
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...TEXT: National Commission on the Restructuring of the IRS and of TEI ' s 
interaction of it. Mr. McCloskey indicated that he would like to get more 
information from TEI on this score. 

Audit Protocol 

Commencing with the 1995 liaison meeting and throughout the ensuing year, 
there have been a number of discussions between representatives of Revenue 
Canada and business taxpayers concerning the Department's audit protocol 
initiative. As a part of the consultation process, the Institute submitted 
formal written comments on the Draft Audit Protocol Reference 
Manual (hereinafter, "the protocol ") on September 27, 1996. In order to 
advance the consultation process and elaborate on the issues raised in our 
written submission, we invite Revenue Canada's comments concerning the 
following . 

(1): The protocol sets forth a framework for managing the audit process 
on a prospective basis. The speed with which taxpayers and Tax Services 
Office Auditors alike embrace the cooperative approach envisioned in the 

protocol , however, may depend upon the resolution of significant, pending 
audit issues in open taxation years. Has Revenue Canada developed any 
measures to expedite the resolution of pending audit issues and cases 
before, or in connection with the implementation of the audit protocol ? 
For example, the backlog of taxpayer Scientific Research and Experimental 
Development (SR&ED) claims is significant in scope and magnitude. Is 
expedited review of these claims envisioned? Are there other "back-year" 
issues that may impede the transition to an audit framework governed by the 

protocol ? 

Response: Revenue Canada recognizes that there are a number of pending 
audit issues in many large corporations which require expedient resolution. 
Because of this, and to address different needs of different corporations, 
all protocols will be developed through a consultative process and each 
corporation will have its own protocol . 

To ensure that all outstanding issues are addressed up-front, "Guidelines 
for developing an audit plan, " which is a key element of the Audit Protocol 
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. . .TEXT: constituency. 

Canada Revenue Commission 

We shall be pleased to hear a brief update and progress report on the 
activities of the Canada Revenue Commission. 

Audit Protocol 

Commencing with the 1995 liaison meeting and throughout the ensuing year, 
there have been a number of discussions between representatives of Revenue 
Canada and business taxpayers concerning the Department's audit protocol 
initiative. As a part of the consultation process, the Institute submitted 
formal written comments on the Draft Audit Protocol Reference 
Manual {hereinafter, "the protocol ") on September 27, 1996. In order to 
advance the consultation process and elaborate on the issues raised in our 
written submission, we invite Revenue Canada's comments concerning the 
following : 

1 . The protocol sets forth a framework for managing the audit process on 
a prospective basis. The speed with which taxpayers and Tax Services Office 
Auditors alike embrace the cooperative approach envisioned in the protocol 

however, may depend upon the resolution of significant, pending audit 
issues in open taxation years. Has Revenue Canada developed any measures to 
expedite the resolution of pending audit issues and cases before, or in 
connection with, the implementation of the audit protocol ? For example, 
the backlog of taxpayer Scientific Research and Experimental Development 
( SR&ED) claims is significant in scope and magnitude. Is expedited review 
of these claims envisioned? Are there additional "back-year" issues that 
may impede the transition to an audit framework governed by the protocol ? 

2. One underlying purpose of the protocol is to engender greater openness 
and trust between Revenue Canada and taxpayers. That trust may be 
undermined where significant decisions affecting the disposition of the... 
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...TEXT: s side, government revenues are not collected in a timely fashion 
and the inventory of open tax years mounts. TEI appreciates both the 
opportunity to comment on the proposals for an audit framework for 
large-file corporations and the government's implicit recognition that 
large-file taxpayers have such a significant stake in the tax compliance 
process . . . 

... the format of its earlier proposals. Notwithstanding the good faith 
nature in which the initial drafts were conceived, taxpayers viewed some 
aspects of the audit protocol framework as intrusive, onesided in favor 
of the government, and counter-productive to the goals of increasing the 
efficiency and currency of audits. Moreover, had... 

. . . the framework to address taxpayer concerns as they arise. In other 



words, a mechanism st^Hd be developed, and timetac^Bestablished, to 

review whether the audit protocol framework in the Reference Manual and 
the manner of its implementation "make sense" in light of changes in the 
tax law, availability of resources, and improvements in audit and 
management practices. Audit protocols , in our view, are evolutionary 
tools that must adapt to their environment. 

Managing the Audit Process 

TEI believes that effective, timely, and efficient audits depend ... there 
are good or best practices that have withstood the test of time, the 
proposed document will be greatly improved and assure taxpayers that the 
protocols will not diminish protections otherwise accorded to them by law 
or customary audit practice. 

Examples of statements that should be included: 
No changes in administrative... 
. . . basis . 

Design, Implementation, and Administration of Protocols 

Absence of a Protocol or Revocation of Existing Protocol. Question and 
Answer 11 of the Draft Audit Protocol Reference Manual states that a 
protocol may be revoked because it is not a legally binding agreement. We 
agree that an audit protocol is an exhortative statement of goals and 
ob j ectives . . . 

... flow from this posture. First, the revocation of an agreement with a 
taxpayer or, more likely the case, the taxpayer's refusal to enter a 

protocol agreement should have no effect on the scope of the audit 
inquiries, the procedures employed, or the number of transactions or 
entities examined. In other words, a taxpayer who refuses to enter a 

protocol (or revokes an existing agreement) should not be subject to more 
rigorous procedures or more onerous requests for documentation than other 
taxpayers of similar size... that a Question and Answer be added to the 
Reference Manual to clarify that no negative inference will be drawn from 
and no more burdensome audit will be conducted as a result of a 
taxpayer's declining to enter into a protocol or revoking an existing 
agreement . 

Administration of Protocols . During the course of nearly every audit, 
circumstances arise that are entirely outside the control of either the 
taxpayer or the government. In administering the protocols , the 
commitments undertaken in the protocol should be viewed as flexible goals 
and objectives rather than rigid checklists. The importance of flexibility 
in the design, implementation, and administration of the agreements in 
particular audit cases should be stressed in the Reference Manual. We 
recommend that a statement be added that emphasizes this. 

Design and Implementation of Protocols . Clearly, the individual protocol 
documents must be tailored to take account of each taxpayer's 
industry-specific issues, the facts and circumstances of the taxpayer's tax 
history and attributes, and its accounting and information system. The 
Reference Manual's outline of a protocol agreement must be viewed as a 
flexible model rather than as a prescribed one-size-fits-all agreement. 
Indeed, we believe it is critical that the audit protocol explicitly 
acknowledge this. Based on Question and Answer 5 of the Reference Manual, 
our recommendation is likely consistent with Revenue Canada's intent. 
Nonetheless, Revenue... 
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...TEXT: of conformity assessment considerations will arise. Issues 
concerning which professionals will be eligible to conduct verification 
audits, how the new standard will be interpreted by auditors , distortion 
of audit findings , and related matters will require resolution. 

The purpose of this article is two-fold. First, the critical features of an 
ISO 9000/14000 harmonized OHSMS assessment instrument (or auditing tool) 
will be described. Second, the critical features will be examined as they 
correlate with conformity assessment protocols . The authors reviewed 
accessible ISO 9001 and 14001 assessment instruments, published and 
unpublished draft ISO standards, investigated industry and governmental 
auditing practices, and reviewed correspondence... 
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...TEXT: use evidence on effectiveness and outcomes to specify quality 
requirements . 

(2) Within audit: 

* establish agreed standards and goals based on evidence of effectiveness; 

* develop treatment protocols incorporating evidence on effectiveness; 

* identify appropriate measures of outcome to monitor the service provided. 
As far as outcomes are concerned, it is clear that much... 

...3) Explore potential causes of condition and health care interventions. 

(4) Select appropriate measures of outcome. 

(5) Review evidence on effectiveness: 

If evidence develop guideline/ protocol . 
-- If lack of evidence: 
-- collect data on desired outcomes; 

audit service against desired outcomes; 
-- commission research. 

(6) Monitor and audit services provided. 

Once having selected a particular intervention or package of care, the 
starting point is to clarify the desired outcomes, moving on to identify 
and explore available evidence on effectiveness. If there is available 
evidence, then an evidence-based protocol or guideline can be developed. 
If evidence is lacking, data on the desired outcomes must be collected 
(purchased) and services audited against these outcome criteria... 



...research may need to commissioned . 

For example, on the basis of evidence as reviewed within Effective Health 
Care bulletin No. 4 (November 1992), a protocol for appropriate referral 
for the treatment of glue ear could be developed, including the guarantee 
of audiometric testing immediately prior to surgery, leading on to clear 
criteria for monitoring the implementation of the protocol , including the 
simple recording of the dry tap rate (a process measure but indicative of 
the appropriateness and, thus, desired outcome of the intervention) . 
Practitioner. . . 
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...ABSTRACT: a training program for auditors. The course text contains 
complete lecture slides, exercise explanations, case studies, an actual 
quality manual used during the exercises, and reference materials. 
Necessary audit protocols include: 1. deciding to perform an audit, 2. 
preparing for an audit, 3. identifying effective audit practices, 4. 
writing discrepancies, 5. conducting a closing meeting, 6. writing reports, 
and 7. verifying corrective actions. As a result of the course, 
certified auditors are now conducting scheduled external and internal 
audits. All auditors understand the requirements of ISO 9001 and ISO 9002 
and can assist their divisions in... 
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...TEXT: decision evaluation, training, and improvement. 

However, tracing auditors' problem-solving behavior is not an easy task. 
This study employs a process-tracing methodology comparable to protocol 
analysis that helps overcome the constraints of sample size, reliability, 
and costs associated with verbal protocol analysis. This is done by 
using a computer-controlled information retrieval system {CIRS) that traces 
the subjects' information search behavior. Three dimensions of information 
search behavior are examined: information search strategy, information 
acquisition, and information search duration. Twenty-four computer audit 
specialists (experts) and 28 non-specialist auditors (novices) 
participated in the study. The audit case implemented on the CIRS involves 
a computerized accounting system for... 

. . . items on the background of the client, the general computer controls, 
the application controls, and the audit decisions. 

Use of the CIRS instead of verbal protocol analysis proved successful in 
enhancing reliability, reducing costs of coding, and expanding sample size. 
In general, experts and novices exhibited different information search 
behavior. Experts... 
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...TEXT: one else was in the office. Later he said he felt that it would 
save her effort and time. In the process, he ignored office protocol . 

The director responsible for the audit received a telephone call from the 
auditee's chief executive officer suggesting that the auditor be removed 
from the . . . 

... guilty, however, of violating good manners. Victimized by the dual 
effects of ignorance of etiquette, on the one hand, and the necessity of 
proper office protocol on the other, this auditor and his department 
suffered unpleasant consequences which might have been avoided. 

Certainly this is only one example, but probably all... 

... deficiencies. Such projects require great sensitivity on the part of 
auditors in order to motivate improvement rather than creating unresolved, 
and sometimes unnecessary, conflict over audit results . Where auditors 
are unable to establish positive, constructive relationships within 
organizations, the contribution of the audit function itself can be 
jeopardized. Our observation has been that successful auditors and 
successful auditing departments tend to practise good people skills, 
including good etiquette, as well as good technical skills. 

A FEW PRINCIPLES AND GUIDELINES AS A BASIS FOR GOOD MANNERS 

Good manners are based on only a few principles of human relations and 
business protocol . Like most detailed procedures, those related to 
etiquette result from a few fundamental general principles and conventions. 

HUMAN RELATIONS 

Taking some liberties in reducing a more extensive and sophisticated 
treatment by. . . 
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. . . granting different levels of access to data based on job 

i;unccion. Network Associates' newest release also logs who taps into the 
Distributed Sniffer System for protocol information. 

For Brian Leafe, a senior technical analyst at Liberty Mutual, an 
insurance company, the appeal of the new package has less to do with... 

...more detailed information about difficult problems that front-line 
personnel couldn't resolve. Third-tier engineers requiring administrator 
rights get full access to all DSS information . 



Leafe added that ^^Bng an audit trail to record^^l is accessing 
protocol information w^Pl come in handy when multiple operators from 
different departments access the DSS server. 

DSS 4.5 also has 125 new protocol decodes. Network Associates 
also is offering more in-depth analysis of HTTP traffic in the package. 
The DSS product is priced from $5,000 for a 10-Mbps... 
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... includes NetSuite Professional Audit 3.0, for detecting the 

network topology; NetSuite Advanced Professional Design 3.0, which 
provides a design schematic to hold the data discovered by the auditing 
engine; NetSuite Toolkit 3.0, a set of tools to customize network design; 
and an expanded version of the NetSuite Library that can be used. . . 

...provide detailed information about the device's operating system, as 
well as installed cards and attached PCs. 

NetSuite Advanced Professional Design 3.0 recognizes network 
protocols , assigns properties associated with them, and validates 
network addresses. For example, a network planner can assign IP addresses 
to certain ports of a switch so that the network... 
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...similar auto claims, 
provider history, etc. This information is gathered from a wide 
spectrum of sources, including the U.S. Department of Labor and 
published protocols from The American Chiropractic Association and 
The American Medical Association. 

In addition, ADP IMS also provides the nation's largest 
repository for P&C injury claims data and settlements which. . . 

...utilizing PBA, all medical bills are submitted 

through an audit process which performs fee review, utilization 

review, duplicate bill verification and administrative checks. 

Once this audit is complete, the information is brought forward 
in ICE for the claim representative to review as the claim is 
evaluated . 

IMS is a division of ADP Claims Solutions Group. . . 
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...analysis and reporting. 

During EDD, extensive investigations are conducted to determine a 
compound ' s 

potential, including pharmacokinetic/ pharmacodynamic (PK/PD) analyses. 

The EP2 system adds protocol and report management to the EP Series, 
allows 

for more flexibility and database connectivity, and is totally protocol 
driven. The major innovations in the new EP2 solution include the 
following : 

Provides open database architecture based on OracleTM. 
Is totally protocol -driven and GLP-compliant . 
Offers the ability to manage and tune data from different 
databases . 

Allows cross-project, cross-study data mining 
Provides high-throughput... 

...examination, study reconciliation and full study 
traceability . 

The EP Series is a scalable technology solution that provides centralized 

data 

management significantly better than before. The protocol -driven 

enterprise 

system maps early drug development business processes and can be easily 
integrated into existing IT infrastructures. 

It: provides intelligent data import and export components, a flexible 
c ross . . . 

. . . Full GLP compliance across the system is managed by a 

security and audit layer which communicates with a set of robust quality 
assurance tools, allowing auditors to perform full data traceability 
through a 

study's life in the system. 

The EP Series allows the creation and management of an unlimited number of 
projects, studies, users, roles and privileges. The system provides 
protocol 

design and approval, which drives the entire system, allowing users to make 
controlled modifications. A powerful audit trail, security and audit agent 
ensure GLP compliance. 

The database accommodates any type of study structure, and directly links 
to 

clinical, laboratory and other data structures which pass through the GLP 
security and audit layer. The system imports data from external 
databases and 

other file sources utilizing a flexible, validated procedure. 
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Abstract: Australian State and Commonwealth Governments are interested in 
Che collection, storage and presentation of audit trail information, 
particularly within a legal framework. Law enforcement agencies have a 
legal obligation to keep audit records of all activity on information 
systems used within their operations. Little to no research has been 
identified in relation to the use of internal audit systems for 
evidentiary purpose. A brief history of audit trails is given with 
requirements for such audit trails beyond the year 2000. The Queensland 
Police Service (QPS) , Australia, is used as a major case study. 
Information on principles, techniques and processes used, and the reason 
for the recording, storing and releasing of audit information for 
evidentiary purposes have been studied. To assist in determining current 
practice in the Australian Commonwealth and State Governments the results 
of an Australia wide survey of all government departments are given and 
contrasted to the major study for QPS. Reference is also made to the legal 
obligations for authorization of audit analysis, expert witnessing and 
legal precedence in relation to court acceptance or rejection of audit 
information used in evidence. It is shown that most organizations studied 
generate and retain audit trails but the approach is not consistent nor is 
it comprehensive. It is suggested that these materials would not withstand 
a serious legal challenge. 17 Refs. 
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Abstract: As a basis for qualification to military fiber optics 
specifications, manufacturers will be required to establish, implement and 
maintain a Product Assurance Program. This program must demonstrate and 
assure that the design, materials, production, inspection and testing of 
fiber optic devices are adequately controlled to sustain operation in a 
military environment. Discussion of the program requirements is in the 
following areas: Management Responsibility for Quality; Product Assurance 
Program; Organization; Design, Processing, Manufacturing, Testing and 
Calibration Procedures; Records to be Maintained; Self Audits; and Process 
Control. 4 refs. 
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Abstract: State and Commonwealth Governments are interested in the 
collection, storage and presentation of audit trail information, 
particularly within a legal framework. Law Enforcement Agencies have a 
legal obligation to keep audit records of all activity on information 
systems used within their operations. Little to no research has been 
identified in relation to the use of internal audit systems for evidentiary 
purpose. A brief history of audit trails is given with requirements for 
such audit trails beyond the year 2000. The Queensland Police Service 
(QPS), Australia, is used as a major case study. Information on principles, 
techniques and processes used, and the reason for the recording, storing 
and releasing of audit information for evidentiary purposes have been 
studied. To assist in determining current practice in the Australian 
Commonwealth and State Governments the results of an Australia wide survey 
of all government departments are given and contrasted to the major study 
for QPS. Reference is also made to the legal obligations for authorisation 
of audit analysis, expert witnessing and legal precedence in relation to 
court acceptance or rejection of audit information used in evidence. It is 
shown that most organisations studied generate and retain Audit Trails but 
the approach is not consistent nor is it comprehensive. It is suggested 
that these materials would not withstand a serious legal challenge. (9 
Refs) 
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The origin and history of data in databases are often as important as the 
data itself. A full audit trail of database operations is the best record 
of a database's history. INGRES provides an audit facility to format 
journal file entries into audit records . This facility is cumbersome 
and difficult to use. I describe two INGRES Report Writer reports that take 
all the effort out of maintaining a complete audit trail. To maintain an 
audit trail of changes to INGRES tables it is necessary to run AUDITDB 
individually on each table and store a record of the AUDITDB output. The 
INGRES manuals suggest how the audit records can be copied into INGRES 
tables for storage. Thus the maintenance of an audit trail consists of: 
creating tables to receive audit records , running AUDITDB, and storing 
the audit records into the tables. All this must be done for each table 
to be audited. My approach to this drudgery is to give it all to the INGRES 
system. Therefore, I present reports that generate command files to create 
the tables and run the audits. The only job left for a human is to submit 
the generated command files to the batch queue. (ERA citation 14:030228) 
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The objective of this American Occupational Therapy Association (AOTA) 
project was to design policies and procedures for occupational therapist 
and occupational therapy assistant competency-based recertif ication . 
Project activities included the exploration and appraisal of various 
methods of recertif ication, such as continuing education requirements , 

audit / record review requirements , and written examination 

requirements . Criteria were developed for use in appraising these and 
other recertif ication methods. Several problems were revealed in the 
appraisal. They related to generalist versus specialist recertif ication and 
continuing education requirements for relicensure. The chart audit / 

record review procedure was evaluated to determine its suitability as a 
competency evaluation instrument for recertif ication purposes, and 
recommendations pertaining to policies and procedures for a recertif ication 
program for occupational therapy practitioners were developed. It is 
concluded that an audit procedure is not feasible as a measure of 
competency. A criterion-referenced examination is proposed for use as a 
competency evaluation instrument for recertif ication . Recertif ication is 
viewed as one component of a larger and more comprehensive program known as 
a competency assurance program. Components of a competency assurance 
program for occupational therapy practitioners are identified. Further 
information on certification requirements and the AOTA is appended. 
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Problem-oriented medical records (POMR) are discussed as a technique for 
judging the quality of psychiatric care. In a paper presented at the 1972 
meeting of the American Psychiatric Association, it was argued that self 
regulation of psychiatry obscures the fact tha there is no meaningful 
regulation of professionals in psychiatry. Attempts to measure physician 
or therapist functioning in psychiatry usually focus on outcome, the most 
direct measure of the goal of therapy: helping a patient with problems 
which brought him to seek therapy. Others have attempted to examine the 
structure of care as a means of making inferences about the quality of 
care. Process analysis for evaluating the quality of mental health care can 
be accomplished in three different ways: direct observation of contacts 
between the therapist and patient, testing of therapists with standard 



hypothetical situatio; 




and record audit 



Record 




It is relatively 



inexpensive, does not interfere with a patient's therapy^^an be performed 
at the convenience of an auditor, and can be done by technicians who screen 
records with checklists prepared by experts. In a problem-oriented record 
system, progress notes are kept to provide a record of patient progress and 
the thinking and actions of physicians regarding specific problems. This 
system is endorsed for two reasons: (1) it has practical assets in terms of 
improving patient care; and (2) it provides a basis for evaluating the 
quality of psychiatric care. 
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The purpose of this study was to examine the relationship between 
first-time uncertainty qualifications and auditor changes. Two separate 
research questions were addressed: (1) Why do some companies change their 
auditors following the receipt of a first-time audit report uncertainty 
qualification and others do not ? and (2) Do companies who change their 
auditors following the receipt of a first-time audit report uncertainty 
qualification receive an unqualified opinion sooner than companies who also 
received a first-time uncertainty qualification, but did not change their 
auditors? 

In answering the first question, nine hypothesis tests were performed 
focusing on the impact of variables measuring the composition and strength 
of the interorganizational relationship, the impact of variables measuring 
the strength of the shock to the interorganizational relationship, and the 
impact of variables measuring the composition and activity of the board of 
directors on the probability that a company would change its auditors 
following the receipt of a first-time audit report uncertainty 
qualification. The results suggest a significant role of interpersonal 
ties between boundary spanners (management, boards of directors, and 
auditors) and structural barriers (length of time the relationship has 
endured and audit difficulty) on the likelihood of an auditor change 
following a first-time audit report uncertainty qualification. The 
results also indicate that the less expected the qualification the more 
likely a company was to change its auditors . Finally, the results give 
no indication of a significant relationship between the composition and 
activity of the board of directors and the probability of an auditor change 
following the receipt of a first-time uncertainty qualification. 

In answering the second research question, two separate hypothesis 
tests were performed. The results of the first hypothesis test indicated 
that it took longer (not shorter) for companies that changed their auditors 
to receive an unqualified opinion (the opposite of what would be expected 
if successful opinion shopping was taking place) . The results of the second 
hypothesis test indicated that the companies that changed their auditors 
were less likely to receive an unqualified opinion, while controlling for 
financial condition; the opposite of what would have been necessary to 
provide evidence of successful opinion shopping. 
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Historically, the accounting profession, through various oversight 
committees and boards, has promulgated standards to regulate the quality of 
the auditing function. One such regulation adopted by the AICPA was the 
creation of the peer review process. The purpose of the present study is to 
address the implications of the peer review process on audit demand, audit 
quality provision, and audit pricing within the auditing market. 

Based on the economic incentives of market participants, hypotheses 
were developed to examine these implications. This study was conducted 
utilizing the experimental markets methodology to examine various 
institutional settings by manipulating the demand for audit quality and the 
availability and timing of the peer review process. 

The results of this study demonstrate that the information provided by 
the peer review process is useful to buyers in assessing the quality of 
services they are receiving. The results indicate that the heterogeneous 
demand for audit quality creates a disparate valuation of the peer review 
process. In markets where audit quality was not important to buyers the 
ability to identify high quality providers by utilizing peer review was of 
minimal value. In markets where high quality audit services were 
demanded, the information provided by a 1-yr peer review process 
increased the quality of audits provided in the market. The 3-year review 
process currently utilized within the profession did not significantly 
alter the market results from the non-peer reviewed markets. 

These results imply that the peer review process has the potential to 
address regulators' concerns regarding the quality of the auditing but that 
the timeliness with which the information is received is critical. The 
results of this study support the ability of the peer review process to 
provide quality differentiating information to buyers of audit services 
that improves their ability to purchase high quality auditing services, if 
desired. 
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The Single Audit Act of 1984 was adopted by Congress to improve 
efficiency and effectiveness in audits of federal financial assistance 
administered through state and local governments (SLGs) . As a result, 
Congress hoped to provide greater assurance as to the credibility of SLG 
compliance with federal assistance guidelines. 

This research studied the relationships between a comprehensive set of 
auditee-based, auditor-based, and audit risk factors and two output 
indicators of single audit quality. The output indicators of quality are 
based on auditor findings included in single audit reports. Data 
were collected for 1987 and 1991. 1987 was selected in order to allow 
public accounting firms a one year grace period to become more familiar 
with the Act, since it did not take effect until 1986. Changes in the 
results between 1987 and 1991 were examined. 

This study sent out a request to all U.S. cities with a population 



size of at least 25, 000J^^is request sought copies of t ^^B 1987 and 1991 
single audit reports and a response to a questionnaire. 

The data were analyzed using tobit and logit regression. The overall 
tobit models for 1987 and 1991 were highly statistically significant. All 
but one of the individual auditee-based, auditor-based and audit risk 
factors in 1987 were significantly associated with the output indicator. In 
1991, only two factors were significantly associated with the output 
indicator . 

The overall logit model results also were statistically significant. 
The coefficient signs for the eight factors were generally consistent with 
the tobit results. The statistical analyses added validity to the 
descriptive results . However, only one auditee -based factor was 
significantly associated with the output indicator of quality. 

Several potential explanations for the previously discussed results 
are presented. 
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Language: English Document Type: Journal Paper (JP) 
Treatment: General, Review (G) 

Abstract: The spread of business reengineering is driving many 
organizations to rethink their operational strategies. Many of these 
enterprises are fighting to reduce costs, to improve the quality of 
products, and to deliver the best possible service to customers. Often, 
these enterprises hope that a new operational philosophy will protect them 
from the impact of increasingly frenzied competition. This article is not 
intended to promote a sense of urgency without substance. However, astute 
information systems auditors realize that organizations cannot afford 
to wait until change occurs spontaneously. Effective change does not 
happen that way. Despite the need for finding radical new approaches for 
carrying out most of an enterprise's processes, it is naive also to believe 
that change will happen evenly. Information systems auditors need to 
display extraordinary vision and leadership to overcome the natural 
resistance to change, both within organizations generally and this 
profession. Mere incremental change in how auditing is done is not enough. 
This article presents one of the ways in which it appears to be desirable 
to reconstruct the way in which auditors do their work. (7 Refs) 

Subfile: C 

Descriptors: auditing; DP management; information systems; management of 
change; systems re-engineering 

Identifiers: information systems auditors ; enterprise process review; 
business reengineering; operational strategies; cost reduction; product 
quality; service delivery; operational philosophy; urgency; change; 
leadership 
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CODEN: EAJOEZ ISSN: 

Language: English Document Type: Journal Paper (JP) 

Treatment: Practical (P) 

Abstract: The local area network (or LAN) will play a major role during 
the 1990s in the development of telecommunications. Developing an effective 
approach to auditing a LAN requires at least two things: understanding its 
unique structure and function, and recognizing that the method to be 
applied in examining and evaluating it is not simply a modification of 
the conventional data communications network audit approach. (0 Refs) 

Subfile: B C 

Descriptors: auditing; DP management; local area networks 
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Abstract: The audit profession has little comment in the support of 
optical disk WORM (Write Only Read Multiple) devices. Magnetic media are, 
for accounting purposes, a giant step backwards from manual ledger books. 
Their principal characteristic is, after all, that they can be altered 
untraceably, which is exactly what auditors don't want! Properly 
implemented WORM devices solve this. They are quite simply the correct way 
to store data that should not be changed and which needs to be stored 
for more than a few days. Most accounting data is like that. (0 Refs) 
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Transaction method in transaction processing system, involves releasing 

locks obtained for transaction after transferring information in audit 
buffer to stable buffer by managers participating in transaction 
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Abstract (Basic): US 20030204771 Al 

NOVELTY - The resource managers participating in transaction are 
registered, and locks for transaction are obtained if no CPU failure 
occurs. A flush request is transmitted to CPUs hosting registered 
managers, to transfer information in audit buffer to stable buffer. 
A lock release request is transmitted to registered CPUs except the CPU 
hosting monitor after transfer operation, and operation completion is 
monitored . 

DETAILED DESCRIPTION - An INDEPENDENT CLAIM is also included for 
processing cluster. 

USE - For performing transaction between processing cluster 
(claimed) in transaction processing system. 

ADVANTAGE - Improves the efficiency of distributed transaction 
protocols by a simple process, thereby improving the performance of 
the transaction as the number of CPUs. 

DESCRIPTION OF DRAWING (S) - The figure shows the structure of the 
transaction processing system. 

clusters (10, 12, 14, 16) 

internal fabric (30) 

external fabric (34) 

CPUs {18a-18f , 20a- 20f , 22a-22f , 24a-24 f ) 
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Abstract (Basic): US 20030195815 Al 

NOVELTY - The custom information system database which consists of 
transaction information identifying the purchased goods, custom 
clarification and valuation of the purchased goods, is connected in 
electronic communication with a custom broker (153) . The custom broker 
access the database to generate custom document including transaction 
information . An audit module audits database using a set of audit 
criteria . 

DETAILED DESCRIPTION - INDEPENDENT CLAIMS are also included for the 
following : 

(1) customs for document generating/auditing method; and 

(2) customs document generating/auditing system. 
USE - For import/export system. 

ADVANTAGE - Generation of customs documents in conformance with 
import /export lawn can be ensured. Location of sources with repeated 
filing errors can be identified. 

DESCRIPTION OF DRAWING (S) - The figure shows the schematic 
representation of interaction between participants. 
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Abstract (Basic): US 20030084073 Al 




NOVELTY - An audit application defined and generated by a master 
database (402) is transmitted to replica databases 

(404,406,408,410,412) by push synchronization. The master database 
forces the replica databases to perform the audit application. After 
auditing , the replica database. synchronizes the results of the 
audit and transmits the results back to the master database, for 
audit result verification. 

DETAILED DESCRIPTION - INDEPENDENT CLAIMS are also included for the 
following : 

(1) arrangement for establishing audit to database system; 

(2) master database server; and 

(3) replica database server. 

USE - For auditing replica database such as object-oriented 
database managed by data processing device such as computer and 
workstation . 

ADVANTAGE - Enables performing audit process of the replica 
database easily, efficiently and reliably, in a secure manner. 

DESCRIPTION OF DRAWING (S) - The figure shows a block diagram of the 
replica database audit provision arrangement. 

master database (402) 

replica databases (404,406,048,410,412) 
pp; 16 DwgNo 1/6 

Title Terms: REPLICA; DATABASE; AUDIT; METHOD; SYNCHRONISATION; RESULT; 

AUDIT; APPLY; PERFORMANCE; REPLICA; TRANSMIT; RESULT; BACK; MASTER; 

DATABASE; AUDIT; RESULT; VERIFICATION 
Derwent Class: T01 

International Patent Class (Main) : G06F-012/00; G06F-017/30 
File Segment: EPI 



10/5/5 (Item 4 from file: 350) 

DIALOG (R) File 350: Derwent WPIX 

(c) 2004 Thomson Derwent. All rts. reserv. 

015319493 **Image available** 

WPI Acc No: 2003-380428/200336 

XRPX Acc No: N03-303831 

Environmental audit information management method for occupation 
heath-safety audit, involves accessing predetermined set of environmental 

audit protocols and associating with audit information to form 
audit record 

Patent Assignee: WESTON INC ROY F (WEST-N) 

Inventor: SMITH L C; VIRAG P E 

Number of Countries: 001 Number of Patents: 001 
Patent Family: 

Patent No Kind Date Applicat No Kind Date Week 

US 20030028544 Al 20030206 US 2001920073 A 20010801 200336 B 

Priority Applications (No Type Date) : US 2001920073 A 20010801 
Patent Details: 

Patent No Kind Lan Pg Main IPC Filing Notes 
US 20030028544 Al 40 G06F-007/00 
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NOVELTY - A predetermined set of environmental audit protocols is 
accessed and associated with a received environmental audit 
information to form an environmental audit record. 

DETAILED DESCRIPTION - An INDEPENDENT CLAIM is also included for 
environmental audit information management system. 

USE - Environmental audit information management for 
environmental heath and safety (EHSS) audit, occupational health and 
safety audit, etc., and also for business applications. 

ADVANTAGE - Improves the quality assurance. Reduces the risk 
through better management tools and documentation. Reduces the cost. 

DESCRIPTION OF DRAWING ( S ) - The figure shows the flowchart 
explaining the environment audit information management process. 
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Abstract (Basic) : JP 2003005757 A 

NOVELTY - A delivery management server (11) receives delivery 
requirement of audio data from audition terminals (40) through an 
internet (10). A company server (12) is provided for selecting and 
delivering the audio data corresponding to the requirement based on 
identification information included in the requirement . 

DETAILED DESCRIPTION - An INDEPENDENT CLAIM is included for CD 
sales method. 

USE - For selling music CD, etc. 

ADVANTAGE - Purchase of music is performed effectively. 
DESCRIPTION OF DRAWING (S) - The figure shows the block diagram of 
the audition system. (Drawing includes non-English language text). 
Internet (10) 

Delivery management server (11) 
Company server (12) 
Audition terminals (40) 
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NOVELTY - An audit module (30) receives externally generated 
commands indicating a type of vending machine data, a data processing 
met: hod and a memory location for storing the data type in audit 
module. The audit module processes vending machine data based on 
che commands. Several configurable mapping tables of the module 
determine storage necessity and storage location of the vending machine 
data . 

DETAILED DESCRIPTION - INDEPENDENT CLAIMS are also included for the 
following : 

(a) Audit module; 

(b) Vending machine 

USE - For audit module (claimed) in configurable vending machine 
(claimed) . 

ADVANTAGE - The vending machine data is changed dynamically without 
upgrading or modifying software code or replacing a semiconductor chip 
on audit module. This provides great amount of flexible with respective 
monitoring and reporting the data. 

DESCRIPTION OF DRAWING (S) - The figure shows the audit module 
configuration . 

Audit module (30) 
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Abstract (Basic) : WO 200198874 A2 

NOVELTY - A processor (1) receives all data from member sites (4) 
connected to the network and information from an open source (2) may be 
used to improve content of the virtual database, while a notarization 
database (3) holds the content of authorization steps of certification 
between the processor and the members. The processor computes a 
notarization process for certification steps using audited 
information from the members and controls access to selected elements 
of the records . 

DETAILED DESCRIPTION - INDEPENDENT CLAIMS are included for 

(1) on-line certification services. 

(2) a member site. 

(3) a data processing system. 

(4) a method of determining conformity of business process steps. 
USE - Electronic virtual certification via a communication network. 

DESCRIPTION OF DRAWING (S) - The drawing shows the system 

Processor (1) 

Member sites (4) 

Virtual database (3) 

Open source (2) 
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Abstract (Basic) : WO 200144968 A2 

NOVELTY - First party transfers to the token store data identifying 
change of ownership of tokens to a second party, and the token store 
updates the ownership data of the tokens to reflect transfer of 
ownership of the tokens to the second party. 

DETAILED DESCRIPTION - In a digital token transaction system, token 
stored in token store comprises value and ownership data, with the 
ownership data identifying a first device. Ownership transfer signal is 
transmitted from first device to the token store. Transfer signal 
identifying a second device, at the token store, modifies the token 
ownership data in response to the transfer signal so that it refers to 
the second device. A purse database is included, adapted to store 
details of purses (A,B) registered with the transaction system and to 
receive a portion of the transaction message relating to authentication 
information and to attempt to authenticate the identity of the first 
purse . 

USE - In financial transactions based on notified changes of 
ownership of statically held tokens. 

ADVANTAGE - Invention prevents collection of auditing or 
profiling data for a particular individual. The tokens may 
incorporate a serial number, which corresponds to the value of the 
token. There is no risk of spending the tokens twice by a given 
individual, as in the case of DigiCash { RTM) . There is no need to 
retain a list of all tokens, which are ever redeemed, hence there is no 
need to encrypt the tokens and copies of the tokens can be passed to 
and between electronic purses of users of the system en-claire. 
Computationally intensive process of Public Key Cryptography may be 
avoided, as may be the process of decommissioning tokens after each 
transaction, followed by re-minting new tokens, thus reducing 
complexity and cost of the system of present invention. Similarly, 
there is no need to protect the tokens of the present invention with 
watermarking or digital signature techniques. Fraudulent spending of 
token or re-assignment of ownership is checked by separating tasks of 
authorising spending party to a transaction and authorising the value 
to be transferred in a transaction, using remote or geographically 
separate servers, purse registers (PR) and token registers (TR) , 
respectively. Thus security of system is increased over system in which 
two functions are performed by a single entity. System can be easily 
scaled in order to provide extra system capacity for further users, by 
the addition of further purses and tokens. Many currencies and 
securities can be represented by tokens of the invention, of which 
protocols allow secure and economic use of in making micro and 
macro-payments. Each purse may communicate with the servers forming 
part of the system without requiring encryption techniques. 

DESCRIPTION OF DRAWING (S) - Drawing shows a schematic block diagram 
illustrating entities making up the system of the first embodiment of 
the invention. 

Purses (A, B) 

Purse register (PR) 

Token register. (TR) 
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Abstract (Basic) : WO 200011619 Al 

NOVELTY - An auditor (14) retrieves a verifiable audit record (22) 
from a notary (18) and compares it to its putatively associated 
auditable document (26) in order to verify it is an accurate' 
representation. Because the record contains author verification 
information (28), the auditor is able to retrieve all the verifiable 
audit records that were submitted to a particular author (10). The 
associated data include information for verifying that a document has 
not been altered . 

DETAILED DESCRIPTION - INDEPENDENT CLAIMS are included for methods 
for performing an audit, for verifying a notary has not changed a 
message digest, for ensuring integrity of data, for collecting all 
documents from an author and for verifying a document. 

USE - Verifying electronic transactions and performing an audit. 

ADVANTAGE - Permitting retrieval of data from a collection based on 
its verified ownership. 

DESCRIPTION OF DRAWING (S) - The drawing is a flow drawing depicting 
creation of an audit record, its submission to a notary and its 
subsequent auditing 

Auditor (14) 

Verifiable audit record (22) 
Notary (18) 

Auditable document (26) 

Author verification information (28) 

Author (10) 
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Management tool for auditing computer database - in which auditor 
selects user-defined data sample, presents it to user who determines 
errors and feeds them back to auditor, and indicates which errors are 
user errors 
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Abstract (Basic) : WO 9323818 A 

The management tool consists of a project manager (110), with an 
audit criteria utility (122), an auditor (112), a sample receiver 
(128), and an audit reporting and analysis utility (130). The project 
manager audit criteria utility comprises a receiver for receiving 
audit criteria and a unit for defining a project (188) according to 
the audit criteria , while the auditor initiates an audit and 
generates a sample which meets the audit criteria . 

The sample reviewer presents the sample to the user (116) and 
receives feedback on the number of errors in the sample, while the 
audit reporting and analysis utility calculates an audit result 
from the feedback and presents this result to the user. 

ADVANTAGE - Provides database audit capabilities that surpass those 
offered by professional information auditors . 
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Abstract (Basic) : WO 9217880 A 

The appts. for non-destructive evaluation of test material (10) 
includes an ultrasonic transmitter /receiver (14) connected to a 
transducer (12) which transmits an ultrasonic or electromagnetic signal 
and receives a return signal from the test material. The return signals 
are processed and shown on a visual display (16). 

They are also digitised (18) and compared with reference 
standards (20) . The signal processor provides an audio signal output 
(22,24,26), determining the most appropriate acoustic characteristic 
e.g. pitch, loudness, to allow the operator to interpret the results. 

ADVANTAGE - Small and rapid changes in signal information less 
easily overlooked using combination of visual and audible information. 
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Abstract (Basic): GB 2135059 A 

A method for non-des tructively grading fruits, including the steps 
of: measuring the intensity of the nuclear magnetic resonance signal 
from either sugar or an organic acid contained in the fruits, and 
referring the measured values so obtained to a predetermined standard 
value to assess the quality of the fruits. 

DE 3402303 A 

The intensity of a nuclear magnetic resonance signal is measured 
for an atomic nucleus whose spin quantum number is not zero in respect 
of sugar and/or an organic acid within the fruit. The measured value is 
compared with a standard qualtiy value. 

The measurement value can be calibrated in various ways, including 
by use of tetramethylsilan or a predefined regression curve. For fruit 
with a known water content a nuclear magnetic resonance spectrum is 
measured and compared with a spectrum corresp. to the water content. 

USES /ADVANTAGES - Classification by quality using the measured 
sugar content or audity as the criterion. Quality is measured 
indirectly with relative ease. A whole group of fruits can be 
individually examined relatively quickly. 
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Abstract (Basic) : US 20030028544 Al 

NOVELTY - A predetermined set of environmental audit protocols 
is accessed and associated with a received environmental audit 
information to form an environmental audit record. 

DETAILED DESCRIPTION - An INDEPENDENT CLAIM is also included for 
environmental audit information management system. 

USE - Environmental audit information management for 
environmental heath and safety (EHSS) audit , occupational health and 
safety audit , etc., and also for business applications. 

ADVANTAGE - Improves the quality assurance. Reduces the risk 
through better management tools and documentation. Reduces the cost. 

DESCRIPTION OF DRAWING (S) - The figure shows the flowchart 
explaining the environment audit information management process. 
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ABSTRACT EP 707264 A2 

A system and method for auditing software packages in a multi-release 
environment is provided. The audit system reads one or more external 
files that specify which packaging rules apply to a particular target 
software package. The audit system also reads package information files 
of the target software package. The package information files specify 
the form and content of the target software package. The audit system 
analyzes the information contained in the package information files to 
determine whether the target software package conforms with the specified 
packaging rules. The packaging rules may include rules relating to 
conflicts between software packages. Under these circumstances, the 
audit system retrieves information about the software packages against 
which the target software package is to be compared before performing 
the audit. The audit system may compare the target software package 
against another software package, or against a database which contains 
information about numerous other packages. The audit system checks the 
detected packaging rule violations against exceptions specified in the 
external files. Rule violations that are permitted by the specified 
exceptions are filtered from the error list. The audit system generates 
an audit report that indicates which rules, if any, were violated, and 
the severity level of each rule violation. The audit system may 
optionally generate exception information to be used in subsequent audit 
operations based on all or portions of the audit report. If the target 
software package passes the audit operation, the database may be updated 
to reflect the target software package. (see image in original document) 
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...SPECIFICATION line consists of an audit rule identifier which 
identifies an applicable audit rule. Preferably, the audit rule 
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English Abstract 

A system, method and computer program product (100) are disclosed for 
collaborative forecasting utilizing a supply chain management framework. 
A global forecast is identified for a plurality of outlets of a supply 
chain and then stored in memory. The global forecast (4400) is 
subsequently transmitted to each of the outlets utilizing a network. 
Feedback relating to the global forecast is received from the outlets 
utilizing the network and stored in memory. The global forecast is then 
altered based on the feedback and the supply chain is managed utilizing 
the altered global forecast. Many other embodiments and aspects are 
disclosed and claimed. 



French Abstract 

L ! invention concerne un systeme, un procede et un produit programme 
informatique (100) concus pour des previsions collaboratives au moyen 
d'un cadre de gestion de chaine d ! approvisionnement . Une prevision 
globale est identifiee pour une pluralite de points de vente d'une chaine 
d ' approvisionnement puis est stockee en memoire. La prevision globale est 
ensuite transmise a chacun des points vente par le biais d'un reseau 
(4400) . Une retroaction relative a la prevision globale est recue des 
points de vente au moyen du reseau puis est stockee en memoire. La 
prevision globale est alors modifiee en fonction de la retroaction et la 
chaine d ' approvisionnement est geree a l'aide de la prevision globale 
modifiee. Plusieurs autres modes de realisation et aspects sont exposes 
et revendiques . 
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X 

Show me who is using the system for my - X 
organization 

Who has done what to my data? X 
I want reporting functionality for audits . X 
We should be able to detect that something X 
isn't right 

We want an audit trail of some sort X 
Want to track information flow X 
Need to know who has access X 

Need to have detailed . information available to... 
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English Abstract 

A method and system for conducting assessments of business parties and 
generating data therefrom. According to one embodiment, the user provides 
assessment characteristic inputs regarding the assessment type, depth, 
and/or objectives to a computer program which, in response to the inputs, 
selects and displays pertinent requirements to be utilized during the 
assessment. Screens are provided to display the requirements, and the 
categories and subcategories related thereto, in a hierarchical fashion. 
The description or standard for each requirement is displayed and input 
boxes and/or buttons are provided to allow the user to enter ratings 
and/or comments or observations regarding each requirement. Such ratings 
and comments can also be provided for each overall category, and 
suggested ratings can be automatically calculated based upon the ratings 
given to the requirements within the categories. For convenience, a 
tablet PC or other handheld computer can be utilized to execute the 



program, and voice recognition technology can be 



French Abstract 

L f invention concerne un procede et un systeme permettant d'effectuer des 
evaluations d'entites commerciales et de generer des donnees a partir 
desdites evaluations. Dans un mode de realisation, 1 ' utilisateur fournit 
des entrees de caracteristiques d 1 evaluation concernant le type, le 
niveau et/ou les objetctifs d 1 evaluation a un programme inf ormatique qui, 
en reponse aux entrees, selectionne et affiche les exigences pertinentes 
a utiliser au cours de 1 ' evaluation . L ' invention concerne des ecrans pour 
afficher d'une maniere hierarchique les exigences et les categories et 
sous-categories liees a celles-ci. La description ou la norme pour chaque 
exigence est affichee et des cases d ! entree et/ou des boutons permettent 
a 1 1 utilisateur d'entrer des notes et/ou des commentaires ou observations 
concernant chaque exigence. Ces notes et commentaires peuvent egalement 
s'appliquer a chaque categorie generale, et des notes proposees peuvent 
automatiquement etre calculees sur la base des notes donnees aux 
exigences a l'interieur des categories. Pour des raisons pratiques, un PC 
tablette ou tout autre ordinateur portatif peut etre utilise pour fournir 
les commentaires. Une fois que 1' evaluation est terminee, des rapports 
peuvent automatiquement etre generes sur la base des donnees d 1 evaluation 
enregistrees . Ces rapports peuvent etre telecharges a un referentiel 
central auquel plusieurs utilisateurs peuvent acceder. Les donnees 
provenant de 1' evaluation peuvent, par ailleurs, etre ajoutees a une base 
de donnees de compilation, et un resume, un classement et autres analyses 
de la base de donnees de compilation peuvent automatiquement etre 
effectues afin d' identifier des problemes majeurs, des tendances, des 
ameliorations et autres. 
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Detailed Description 

. . . previous assessments made by the same auditor. 



The lack of detail provided in any written descriptions which may be 
utilized for the various categories and requirements allows for 
frequent inconsistency as well as widespread subjectivity from assessment 
to assessment. Accordingly, it can be very difficult to compare 
assessments of various business... 



..a party's goods or services should continue to be utilized, and whether 
a party is making improvements in any of the assessed categories. 

The comments and ratings provided by auditors in conventional 
assessments are usually very text intensive as well. Accordingly, during 
such assessments, the auditor usually takes notes on paper or 
dictates ratings and comments into a conventional dictaphone. Once all 
the categories and requirements have been evaluated, the auditor then 
utilizes the notes and recordings to prepare a report regarding the 
business party. 

However, preparation of such a report can be time consuming and 
inefficient, because organizing and... 



notes can be complex. Moreover, in order to make the report 



•understandable, the aucffPbr usually must spend time to iJ^Pterate each 
assessment category and the requirements relating to that category 
before providing the evaluation for that category. As can be understood, 
such reiteration can be quite time consuming and inefficient, especially 
when there are a number of assessment categories and requirements . 
Finally, the report format, content , and style utilized by various 
auditors can vary, compounding the difficulty in quickly comparing and 
reviewing multiple assessments. 

Assigning ratings for each category which is assessed can also be 
subjective . 

While the auditor may identify many deviations regarding the various 
requirements 

3 

within the category, the business importance of each specific 
requirement and its deviations ...upon these inputs, a subset 278 of 
the relevant requirements is automatically selected and/or saved, and 
then displayed to the user by selecting these requirements having 
identifiers 276 corresponding to the setup input. The user then enters 
ratings and/or observations with respect to the various requirements . 
In addition, 
30 

ratings and observations can be made with respect to the various 
categories of the various requirements in the subset 278, as well as an 
overall rating for the assessment. The ratings and observations can be 
stored, along with the requirements to which they relate. 

Then, from the stored data, a report 281 can be automatically generated 
showing the categories and requirements and the ratings/observations 
regarding each, such as by matching identifiers for requirements and 
categories with descriptions relating thereto. 

The data can be automatically summarized, sorted, analyzed, and formatted 
as desired in the report 281. Each report 281 from each assessment can 
then . . . 

.by using electronic devices in various remote locations. Moreover, the 
data can be exported to a central data repository 283 where it is 
combined with data from other audits . This data repository 283 can 
be accessed by users for electronically sorting, searching, summarizing 
and analyzing the data of all assessments, as well as identifying 
critical issues... 
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English Abstract 

A context management framework is given that provides in various 
embodiments, numerous advantages over previously-existing systems. In 
some instances, an architecture having a centralized storage location 
coupled to a context manager is provided for servicing and logging 
context events from a plurality of sources. This type of system uses a 
synchronization scheme to perform orderly storage and retrieval of data 
to and from the centralized storage location. In other instances, 
information stored in the centralized storage location or signals from 
the context manager are used to achieve an auditing capacity for 
reviewing and acting on context data events and gestures. Selective 
blocking or allowance of impending context gestures or data-access events 
is accomplished based on a rule set or lookup table containing rules or 
ci her data to make such access-control decisions. Access to private data 
r. : nd or. her security measures may thus be implemented using the teachings 
presented herein. Furthermore, a communication paradigm, using a 
Web-proxy, which identifies ordinarily-unidentified applications to a 
concert manager is provided according to some embodiments of the 
invention . 



French Abstract 

L' invention concerne un cadre de gestion de contexte presentant, dans 
divers modes de realisation, de nombreux avantages par rapport aux 
systemes preexistants . Dans certains cas, une architecture comprenant un 
emplacement de stockage centralise couple a un gestionnaire de contexte 
permet de gerer et d ' enregistrer des evenements de contexte en provenance 
d'une pluralite de sources. Ce type de systeme utilise un programme de 
synchronisation destine a effectuer, de maniere ordonnee, un stockage et 
une extraction de donnees dans et depuis cet emplacement de stockage 
centralise. Dans d'autres cas, les informations stockees dans 
1 ' emplacement de stockage centralise ou les signaux provenant du 
gestionnaire de contexte sont utilises pour obtenir une capacite de 
verification permettant d' analyser les gestes et les evenements de 
donnees contextuelles et d'agir sur ceux-ci . On realise un blocage 
selectif ou 1 ' on accorde 1 ' autorisation d'empecher des gestes de contexte 
ou des evenements d'acces aux donnees sur la base d'un ensemble de regies 
ou d'une table de recherche contenant des regies ou d'autres donnees 
permettant de prendre ces decisions de controle d'acces. L'acces a des 
donnees privees et d'autres mesures de securite peuvent ainsi etre mis en 
oeuvre au moyen des apprent issages presentes dans la description. Par 
ailleurs, dans certains modes de realisation, 1' invention comprend un 
paradigme de communication utilisant un mandataire Web qui identifie les 
applications non identifiees ordinairement a un gestionnaire de contexte. 
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Claim 

. . . to (C) : 

(D) collecting point-of-use data identifying a point-of-use machine. 



33 The method of claim^r further comprising: 
(D) evaluating the audit data to make an assessment oT compliance 
with a 

set of regulations . 

34 The method of claim 3 3 . wherein the set of regulations 
corresponds to the HIPAA. - 27 

35 The method of claim 1, wherein (B) comprises storing of the context 
data according to a synchronization scheme that combines... 
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At least one data entry device such as a business card scanner for 
entering personal and/or company information, at least one monitor such 
as a touch-screen monitor for displaying the information and 
interactively acquiring additional information, at least oen digital 
signature pad for receiving a handwritten signature impression from the 
user and converting it to a digital signature, and at least one computer 
electronically connected to the data entry device, the monitor, and the 
signature pad. The computer is preferably programmed to receive and 
electronically store the information from the data entry device, receive 
and electronically store the digital signature from said signature pad, 
and associate the signature with said information. A housing can be 
provided for the computer, data entry device, monitor, and signature pad. 




V ranch Abstract 

Selon la presente invention, au moins un dispositif de saisie de donnees 
tel qu ' un numeriseur de cartes de visite, sert a entrer des informations 
personnelles et/ou d ' entreprise , au moins un moniteur tel qu'un moniteur 
a ecran tactile, sert a afficher les informations et a acquerir de facon 
interactive des informations supplementaires , au moins un pave de 
signature numerique sert a recevoir une impression de signature 
manuscrite de la part de 1 ' ut ilisateur et a la convertir en une signature 
numerique, et au moins un ordinateur est electroniquement connecte au 
dispositif de saisie de donnees, au moniteur, et au pave de signature. 
L' ordinateur est de preference programme pour recevoir et enregistrer 
electroniquement les informations issues du dispositif de saisie de 
donnees, pour recevoir et enregistrer electroniquement la signature 
numerique issue du pave de signature numerique, et pour associer la 
signature auxdites informations. Un boitier peut etre utilise pour 
1 * ordinateur , le dispositif de saisie de donnees, le moniteur et le pave 
de signature. 
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. . . for manually typing in the information using a keyboard in lieu of 
scanning from a business card. The data is stored in a retrievable file 
associated with the 
3 

SUBSTITUTE SHEET { RULE 26) 

user. The touch-screen allows the user to select options such as viewing 
a video or placing an order for a product. 

None of these devices or methods, however, provide for the storage and/or 
printing of a signed document meeting the aforementioned strict audit 
requirements of the publishing and exhibition industries. For these 
devices and methods to be used to satisfy the audit requirements , all 
the information would have to be printed onto physical documents and 
signed, which signed documents would have to be stored for later 
reference. Also, none of these... 
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English Abstract 

A health care system includes a hosted environment (4, 6) that provides 
health care treatment, diagnosis, and/or management. Health care 
providers (2a-2g) are linked to one another and to a central network, 
which is linked to patient (3a, 3b) via the hosted environment. The 
patient (3a, 3b) interfaces with the hosted environment (4, 6), which 
provides the global access to the health care provider (2a-2g) . The 



patient may also have mMfi-cal devices (7) that f acilita^^ollection of 

vital sign data (e.g., digital thermometer) and administration of 
treatment (e.g., medicine dispensary). The health care provider (2a-2g) 
can license the hosted environment (4, 6) to generate the treatment tree 
and perform the treatment. Thus, treatment is performed remotely based on 
globally standardized protocols. Additionally, a virtual clinical 
research organization (CRO) is provided, such that treating physicians 
and patients can participate in clinical trials and have access to new 
medical treatments. 



French Abstract 

La presente invention concerne un systeme de soins qui comprend un 
hebergeur (4, 6) qui fournit des traitements medicaux, des diagnostics 
et/ou une gestion. Des fournisseurs de soins de sante (2a-2g) sont en 
liaison les uns avec les autres et avec un reseau central, lequel est en 
liaison avec un patient (3a, 3b) via cet hebergeur. Le patient est en 
interface avec 1* hebergeur (4, 6) qui fournit un acces mondial au 
fournisseur de soins (2a-2g) . Le patient peut aussi posseder des 
dispositifs medicaux (7) qui facilitent le recueil de donnees de signes 
vitaux (par exemple un thermometre numerique) , et 1 ' administration de 
traitement (par exemple un dispensaire medical). Le fournisseur de soins 
(2a-2g) peut autoriser 1 ' hebergeur (4, 6) a generer le schema du 
r raicement et a realiser ce traitement. Ce traitement est ainsi realise a 
distance a base de protocoles normalises au niveau mondial. De plus, un 
orqanisme de recherche clinique virtuel (CRO) est prevu, de sorte que les 
medecins traitants et les patients puissent participer a des essais 
ciiniques et puissent acceder a de nouveaux traitements medicaux. 
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Detailed Description 

... are repeated until the answer is ' TES". If so, then all incident 
information, is entered into the electronic medical history, so as to 
append the audit trail and the patient information for more accurate 
future treatment, at step S18. Step S18 is standardized. In step S19, the 
billing requirements (e.g., insurance payment) are administered, to 
complete the online process. 

In a first: example of the preferred method illustrated in Figures 3a and 
3b. . . 

...patient logs onto their personalized website using the patients' 
personal code with allergy symptoms. 

The patient provides the necessary- information through screens that 
incorporate the standard of practice and protocols related to 
allergies to tue sponsor network. The information provided by the patient 
is correlated with, the patient's medical record and history for past 
episodes . . . 
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23 A database comprising: 
data corresponding to at least one identified data collector; 
data corresponding to a time for collection of identified data for a 

standard documentation file; and 
data corresponding to the standard documentation file. 

24 A database according to Claim 23 further comprising data 
corresponding to an evaluation of the effectiveness of collected data. 

25 A database according to Claim 23 wherein said data 
corresponding to the standard documentation file comprises data 

documenting a transaction. 

26 A database according to Claim 23 wherein said data 
corresponding to the standard documentation file comprises data 

provided by external deal teams and internal deal teams. 

27 A database according to Claim 23 further comprising data 
corresponding to a percent completion of the standard documentation 



Claims 



Claim 



file. 



28 A database according to Claim 23 wherein said data 
corresponding to the standard documentation file comprises at least 

one of data associating a pre-closing file with an audit report, data 

regarding accounts receivable aging and data relating to a top ten 
customers by sales volume. 

29 A database according to Claim 23 further comprising data... 
..corresponding to a due diligence checklist; 

a server configured to prompt a user to identify data that will be used 
to form at least one standard documentation file, identify at least one 
data collector to collect the identified data and to (inverted 
exclamation mark)dentify a time for collection of the... 

..comprises at least one of data corresponding to at least one identified 
collector, data corresponding to a time for collection of identified data 
for a standard documentation file, and data corresponding to the 
standard documentation file. 

41 A -systein according to Claim 40 wherein said database 
comprises data corresponding to an evaluation of effectiveness of 
collected data. 

42 A system according to Claim 40 wherein -said database 

comprises data corresponding to a percent completion of the standard 
documentation file. 

43 A system according to Claim 40 wherein said data 
corresponding to the standard documentation file comprises data 

associating a preclosing file with an audit report, data regarding 
accounts receivable aging and data relating to a top ten customers by 
sales volume. 

44 A method for conducting due diligence, said method 

comprising the steps of. selecting, from an electronic interface, data to 

be used to form at least 

one standard documentation file; 

selecting, from the electronic interface, at least one data collector to 
collect the data; and 

requesting, from the electronic interface, a standard documentation 
file. 

45 A method according to Claim 44 further comprising the step of 
selecting, from the electronic interface, a time for collection of 
identified. . . 
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English Abstract 

A method for the tracking of biological samples and information obtained 
from those samples during clinical studies is provided. In particular, 
the present invention provides a method that facilitates the tracking, 
analysis, and reporting of genotype information derived from biological 
samples taken from individuals during clinical studies. The method 
includes recording predetermined characteristics of biological samples in 
a database, determining procedures to be performed on those samples, 
determining sample attributes to be recorded, preparing a checklist that 
includes the procedures and attributes, storing the checklist in the 
database, performing the procedures and recording the results in the 
database. The present invention provides an automated system for tracking 
clinical study protocols, and allows access to information regarding a 
clinical study to be obtained from a central database. Accordingly, 
reports regarding the location, chain of custody, test results, and other 
information concerning samples in a study can be obtained in a highly 
automated fashion. 

French Abstract 

L' invention concerne un procede de localisation d ' echantillons 
biologiques et d ' informations obtenues de ces echantillons au cours 
d' etudes cliniques. Plus specialement , 1' invention concerne un procede 
qui permet la localisation, 1' analyse, le rapport d' informations de 
genotype tirees des echantillons biologiques extraits d'individus au 
cours d' etudes cliniques. Le procede consiste a enregistrer des 
caracteristiques predeterminees d ' echantillons biologiques dans une base 
de donnees, a determiner les procedures a effectuer sur ces echantillons, 
a determiner les attributs d ' echantillons a enregistrer, a preparer une 
liste de controle comprenant les procedures et les attributs, a stocker 
la liste de controle dans la base de donnees, a effectuer les procedures 
et a enregistrer les resultats dans la base de donnees. La presente 
invention concerne un systeme automatise permettant de localiser des 
protocoles d'etudes cliniques, et d'acceder a des informations liees a 
une etude clinique devant etre obtenue d'une base de donnees centrale. De 
cette facon, les rapports ayant trait a 1 ' emplacement , a la chaine de 
possession, aux resultats des tests, et a d'autres informations liees aux 
echantillons d'une etude peuvent etre obtenus de maniere fortement 
automatisee . 
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also be accessed. Changes made to the database also are tracked by the 
system, allowing complete and accurate auditing of samples from clinical 
studies and associated clinical study protocols . An audit report, 
according to one embodiment of the present invention, is illustrated in 
Fig. I 0. The information included in an automated audit report may 
be selected by the user, depending on the parameters of interest. 

Reports containing results of a clinical study can be easily generated 
using . . . 
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English Abstract 

Real-time program audit software that is a method and systemfor 
generating source program audit statements (33 of fig 5) and data as the 
program executes. These audits provide real-time execution analysis (600) 
of the program. The real-time audit is applicable to virtually any 
programming language that uses source program statements, whether the 
source statements are compiled into an executable object or are 
interpreted during execution. Program execution audits are based on the 
initial execution audit profile (26), customized execution audits, or 
dynamic audits specified during program execution. Program audit output 
is to disk, and is available for immediate online display or printing, or 
for expanded auditing analysis. Expanded auditing analysis provides for 
extensive analysis of the real-time program audit output data from all 
audited programs based on the desired analysis (22), which includes: 
program, user, date and time ranges, audit code prefix, audited file, 
field (24), label, and any execution audited data value. 

French Abstract 

Cette invention se rapporte a un logiciel de verification de programme en 
temps reel, qui est constitue par un programme logiciel, a un procede et 
a un systeme servant a produire des instructions de verification de 
programme source qui fournissent des analyses d ' instructions de programme 
et des donnees au cours de 1' execution du programme. Ces verifications 



permettent 1' analyse eiWemps reel de 1' execution du prd^^mme . La 

verification de programme en temps reel est applicable virtuellement a 
n 1 importe quel langage de programmat ion qui utilise des instructions de 
programme source, peu importe que ces instructions sources soient 
compilees en un objet executable ou soient interpretees pendant 
l f execution du programme. Des programmes sources traditionnels sont 
selectionnes pour verification sur la base d ' un profil de verification; 
le profil de verification est personnalise pour des options de 
compilation et d 1 execution initiale specifiques; le programme source est 
developpe avec les instructions de verifications select ionnees ; et le 
programme source est compile a 1'aide d'un compilateur de langage 
traditionnel . Les verifications d' execution du programme sont basees sur 
le profil de verification d 1 execution initial, sur les verifications 
d' execution personnalisees ou sur des verifications dynamiques specif iees 
pendant 1' execution du programme. La sortie de verification du programme 
s'effectue sur le disque et elle est disponible pour un affichage ou une 
impression en reseau immediat ou pour une analyse de verification 
developpee. L ! analyse de verification developpee permet une analyse 
extensive des donnees de sortie de verification de programme en temps 
reel a partir de tous les programmes verifies sur la base de 1' analyse 
souhaitee, ces donnees etant notamment le programme, 1 ' utilisation, les 
periodes exprimees en date et en heure, le prefixe de code de 
verification, le fichier verifie, le champ, l 1 etiquette et toute valeur 
de donnees verifiees d'execution. 
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Examination 20010712 Request for preliminary examination prior to end of 

19th month from priority date 

Search Rpt 20030828 Late publication of international search report 
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Main International Patent Class: G06F-009/45 
Fulltext Availability: 
Detailed Description 

Detailed Description 

... Fig. 9B shows the auditing to disk selections 205,206 
for the pre-compiler program 200. If the programmer has 
selected the option 205 to audit operation codes or data 
fields to disk, then the programmer must insert the File 
description source statements for the audit execution 
output file 42 into the source program statements. Audit 
execution output file 42 source statements are copied from 
the audit master information . Related files, records, 
fields, and standard processing routines for this function 
are also copied. All audit disk output will be written to 
the audit execution output file 42 disk. Alternatively, 
the programmer may select option 206, to effect the basic 

auditing of operation codes or data fields to disk. . In 
this case, the programmer must insert the file description 
source statements for the audit execution output file 42 
into the source program statements. The program copies the 
current execution audit options file 43 source statements 
from the audit master information . Also, the program 
copies related file, record, field, and standard processing 
routines for this function. The current execution audit 
options file 43 is the audit execution options disk files 
which controls which of the audit options are active during 
program execution. 

As shown in Fig. 9C, if the programmer has selected 

option 205 to audit operation codes or data fields to disk, 

and then selects option 207, the programmer inserts the 

file description source statements for the audit execution 

analysis printer file into the source program statements. 



•The program copies the^fcit execution analysis report 
file source statements from the audit master information 
and copies related files, records, field information, and 
processing routines for this function. This print record 
output is formatted in a manner similar to the... 
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English Abstract 

A computer implemented system and method and a computer readable medium 
for complying with the requirements of a quality standard known as ISO 
9000. The areas covered include controlled documentation, training 
management, meetings and reports, process improvement requests, project 
management, and audit management. All controlled documents have a 
security and revision control portion that controls the access and 
approval capabilities of the documents. The system is form controlled. 
Certain individual fields of the forms require the entry of data, and 
field's control are controlled by certain fields of other forms, with the 
fields being updated by other fields in the system, operator entry of 
data, and a combination of control by both the system and operator entry. 
The system includes an ISO matrix relating each document to an ISO 
clause. The system has a controlling document for each delineated 
activity, and all other documents relating to such activity are linked as 
a child of the controlling document. An audit trail is created by storing 
and making available previous iterations of current documents as child 
documents, insuring that the first issue, subsequent changes to content, 
movement to draft status, retrieval, and reissue are available for 
auditing the activities of the business. 

French Abstract 

Systeme et procede mis en oeuvre par ordinateur et support informatique 
permettant de se conformer aux exigences de la norme de qualite ISO 9000. 
Les domaines couverts sont les documents geres, la gestion de la 
formation, les reunions et les comptes-rendus , les demandes 
d ' amelioration de procedes, la gestion de projets et la gestion de 
controles. Tous les documents geres ont une zone de gestion de securite 
et de revision qui permet de gerer les acces et approbations des 
documents. Le systeme fonctionne au moyen de f ormulaires . Certaines zones 
indi viduelles des formulaires necessitent la saisie de donnees, et des 



elements de gestion de zones sont geres a leur tour certaines 

zones d'autres formulaires, ce qui fait que les zones sont mises a jour 
par d'autres zones du systeme, par des introductions de donnees faites 
par un operateur, et par une combinaison de commandes realisees aussi 
bien par le systeme que par les interventions de 1' operateur. Le systeme 
comprend une matrice ISO mettant en relation chaque document avec une 
clause ISO. Le systeme possede un document de gestion pour chaque 
activite precise, et tous les autres documents se rapportant a cette 
activite ont une liaison de type fille avec le document de gestion. La 
creation d'un suivi de verification consiste a stocker et a rendre 
disponible des occurrences anterieures de documents courants tels que des 
documents filles, assurant ainsi que la premiere version, les 
modifications ulterieures de contenu, le passage a I'etat document 
preliminaire, les acces en lecture et la nouvelle version soient 
disponibles pour verifier les activites de 1 ' entreprise . 

Main International Patent Class: G06F-017/30 
International Patent Class: G06F-17:60 
Fulltext Availability: 
Detailed Description 

Detailed Description 

... a master list is automatically generated which 

includes a document number, title, review authority, approval 
authority, and titles, which is a vehicle for satisfying the 
requirements of Sections 4 4.16, and 4.17 of the ISO 
standards as set forth in the referenced publication. 



The audit management module 20 provides an electronic 
trail of individual audit activities as well as audit 
schedules. A controlling planning document is created, and 
checklists, audit findings , corrective action reports, and a 
record of managements acknowledgement of audit findings are 
all maintained as child documents of the planning documents. 

Corrective action reports indicate current status (open or 
closed) in a summary view, which facilitates... 

.The audit management module 20 also 

supports items which do not fall into non-compliance status, 
but may in the future. These are identified as observations 
and ties them to the audit in which they were found. 

Audit schedules are produced automatically by the system 
simply by planning individual audits and filling in the 
planning document. A... 

.to assist in planning. This allows the internal 
audit function to be moved to frontline organizations and 
assists in cross-functional training and propagation of 
information . 

Thus, the audit management module is a vehicle for 
complying with Section 4.14, as well as Sections 4.16 and 
4.17 of ISO 9000 standards as set forth in the referenced 

publ ica tion . 

The project management module 18 creates and audit trail 
i or. all project activities, and enhances on organizations 
ability to take advantage of lessons learned... 

. to the 

project are child documents and retained as an audit trail. 

These documents are: Project Plan, Tasks, Project Issues, 
Task Issues, Meeting Minutes and requirement documents, 
Individual test results are logged from within the Test Plan. 



Test results 
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English Abstract 

The present invention provides systems and methods for electronic 
commerce including secure transaction management and electronic rights 
protection. Electronic appliances such as computers employed in 
accordance with the present invention help to ensure that information is 
accessed and used only in authorized ways, and maintain the integrity, 
availability, and/or confidentiality of the information. Secure 
subsystems used with such electronic appliances provide a distributed 
virtual distribution environment (VDE) that may enforce a secure chain of 
handling and control, for example, to control and/or meter or otherwise 
monitor use of electronically stored or disseminated information. Such a 
virtual distribution environment may be used to protect rights of various 
participants in electronic commerce and other electronic or 
electronic-facilitated transactions. Secure distributed and other 
operating system environments and architectures, employing, for example, 
secure semiconductor processing arrangements that may establish secure, 
protected environments at each node. These techniques may be used to 
support an end-to-end electronic information distribution capability that 
may be used, for example, utilizing the "electronic highway". 

French Abstract 

Systemes et procedes destines au domaine du commerce electronique, et 
notamment a la gestion securisee des transactions et a la protection 
electronique des droits. Les appareils electroniques tels que les 
ordinateurs utilises conformement a la presente invention permettent 
d' assurer que les informations ne sont consultees et exploitees que de 
maniere autorisee, et ils conservent I'integrite, la disponibilite et/ou 
le caractere confidentiel des informations. Les sous-systemes securises 
utilises en association avec de tels appareils electroniques constituent 
un environnement de distribution virtuel distribue (VDE) apte a imposer 
une chaine securisee de traitement et de commande, par exemple pour la 
commande et/ou la mesure ou encore le controle de 1 ' utilisation 
d ' informations stockees ou dif fusees electroniquement . Cet environnement 



'de distribution virtuel^Peut servir a proteger les droid^^e differents 
individus impliques dans le commerce electronique et dans d'autres 

ou assistees par des moyens electroniques . On 
ronnements et architectures de systeme 
securises et autres mettant en oeuvre, par 
iraitement securise a semi-conducteurs pouvant 
securises et proteges au niveau de chaque 
mt servir de soutien pour une fonction 
:>n d ' informations de bout en bout, cette 
par exemple, dans le domaine de 1 ' "autoroute 
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Detailed Description 
. . . systems . 

Controlling Electronic Content 

The present invention provides a new kind of 'virtual 
distribution environment" (called "VDE 1 in this document) that 
secures, admini ters, and audits electronic information use. VDE 
also features fundamentally important capabilities for managing 
content that travels ''across' the 'information highway." These 
capabilities comprise a rights protection solution that serves... 
distribution model. A group of these pieces can represent the 
capabilities needed to fulfill the agreement (s) between users and 
providers. These pieces accommodate many requirements of 
electronic commerce including. 

the distribution of permissions to use electronic 
in forma t ion ; 

che persistence of the control information and sets of 
control information managing these permissions; 
configurable control set information that can be 
selected by users for use with such information ; 
- 17 

data security and usage auditing of electronic 
information ; and 

a secure system for currency, compensation and 
debit management. 



For electronic commerce, a rights application, under the 

preferred embodiment of the present invention, can ... capabilities are 

required to implement an electronic commerce environment. 

VDE is the first system that provides many of these capabilities 
and therefore solves fundamental problems related to electronic 
dissemination of information. 



Electronic Content 

VDE allows electronic arrangements to be created 
involving two or more parties. These agreements can themselves 
comprise a collection of agreements between participants in a 
commercial value chain and/or a data security chain model for 
handling, auditing , reporting, and payment. It can provide 
efficient, reusable, modifiable, and consistent means for secure 
electronic content: distribution, usage control, usage payment, 
- 21 

usage auditing , and usage reporting. Content may, for example, 
include . 

I financial information such as electronic currency and 
credit; 

1 commercially distributed electronic information such 



oisir.ibueor 106 can corWPEl use of content that has alr^^B been 
(or will in the future be) delivered. 'Rules and control^^may be 
delivered over a path different from the one used for content 
delivery. " Rules and controls" may also be delivered at some 
other time. The content creator 102 might deliver content to 
content user 112 over the electronic highway... 

..content or generate a usage permission. Some 
events may need additional processing, and others may not. 

Whether an "event* needs more processing depends on the " rules 

and controls" corresponding to the content. For example, a user 

who lacks permission will not have her request satisfied (No 

Go'). As another example, each user request to... sound such as a mu ical 

performance or a reading, a movie or other video, computer 

software, or just about any other kind of electronic information 

you can think of. Other types of 'objects" 300 {such as 

"administrative objects') may contain ' admini trative" or other 

information instead of or in addition ... container 302, 

and can also control how information content is to be charged 

based on "metering." Methods 1000 may apply to one or several 

different information contents 304 and associated containers 302, 

as well as to all or specific portions of information content 304. 



Secure Processing Unit (SPU) 

The WDE part icipants ... volatile (i.e., it does not lose its contents 
when power is turned off) . 

High-speed RAM 534a stores active code to be executed 
and associated data structures. 



NVRAM 534b preferably contains certain keys and 
summary values that are preloaded as part of an initialization 
process in which SPU 500 communicates with... 
. . .212 

information associated with the operation of SPU 500. For 
security reasons, certain highly sensitive information (e.g., 
certain load modules and certain encryption key related 
information such as internally generated private keys) needs to 
be loaded into or generated internally by SPU 500 from time to 
time but, once loaded... be 
- 228 

locally resident, remotely accessible, or carried along by the 
process to support execution on a remote system. 

ROS 602 provides distribution of control information , 
including for example the distribution of control structures 
required to permit 'agents' to operate in remote environments. 

Thus, ROS 602 provides facilities for passing execution and/or 
information control as part of emerging requirements for "agent* 
processes . 

If desired, ROS 602 may independently distribute control 
information over very low bandwidth connections that may or 
may not be "real time' connections. ROS 602 provided by the 
preferred embodiment is 'network hiendly, ' and can be 
implemented with any level of networking protocol . Some 
examples include e-mail and direct connection at approximately 
"Layer 5" of the ISO model. 

The ROS 602 distribution process (and the associated 

auditing of distributed information ) is a controlled event that 
itself uses such control structures. This "reflective" distributed 
processing mechani m permits ROS 602 to securely distribute 
229 

rights and . . . 



i 



* Claim 

... or other admini trative 

information by one or more parties. 

290. A system as in claim 287 where the associating 

mean further includes means for associating at least one 

requirement that audit information be collected and delivered to 
one or more auditing parties, and the delivering means includes 
1032 

means for delivering at least a portion of such audit information 

to one or more parties. 

291. A system as in claim 288 further including means for 
automatically processing at least a portion of such audit 

information , and the system further includes means for 
transmitting further accounting, admini trative and/or audit 

information to one or more parties that may be the same and/or 
differ from the one or more parties from whom audit information 
was received based at least in part on the receipt and/or content 
of such received audit information. 
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..SPECIFICATION fiscal bases 24 which, when so configured, provide a point 
of sale device according to the present invention. 



Referring now to FIC^^p, operations for auditing t^B verifiable 
electronic journal sysrem will now be described for an ^moodiment of the 
present invention. At block 150, the data signature contained in the 
journal . . . 

.the agreed hash function 126. Finally, at block 154, the verification 
data signature is compared to the decrypted data signature to determine 
if the transaction information in the journal memory has been 
modified from the transaction information which was originally 
transferred from the random access memory of the acquiring point of sale 
device, such as the fiscal base, during the journal period. . . 
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manipulating interface features for storage/retrieval information related 
co directing messages, while restricting access to any stored messages. 
In a voice mail system, the storage/retrieval interface feature includes 
Lhe greeting that is presented to a calling party. A first access code, 
such as a password, is assigned to enable access to the interface 
features, while a second access code is assigned to enable 
message-retrieval. In the preferred embodiment, changes to a greeting or 
the like are reported in an audit message that is stored in the user's 
mailbox. The audit message is automatically generated. The audit message 
notifies the user of the history of any changes. Changes to a greeting 
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...SPECIFICATION access code is used to provide only limited access. Thus, 
a designated person other than the particular user, such as the user's 
supervisor, may non -intrusively change storage/retrieval information 

if the user is unexpectedly absent. Again referring to the voice mail 
example, a supervisor can change a personally recorded or automatically 
generated greeting to... 

...che supervisor will not be able to retrieve any messages stored for the 
unavailable user. 

In the preferred embodiment, the change to the storage/retrieval 
information is recorded to provide an audit trail. An audit message 
may be stored in the mailbox of the user, with the audit message 
identifying both the person that initiated the change... 
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ABSTRACT EP 764911 Al 

The present invention is directed to a global emergency medical 
information communications system and method for delivering medical 
information via credit card transaction terminals located in emergency 
rooms, emergency vehicles, and other remote locations around the world. 
The various embodiments disclosed incorporate a medical information 
database capable of delivering medical information to transaction 



terminals. The system method incorporates the use d^^xisting public 

switched telephone networks, existing credit transaction networks, or 
other networks for effecting the delivery of medical information. 

In accordance with the invention, a subscriber to the system swipes a 
subscriber card, registered credit card, or other registered access card 
at a credit card transaction terminal. The request is then communicated 
via either the public switched telephone network or existing credit 
transaction network to the central medical information database. The 
database then verifies the cards and delivers the associated subscriber 
medical information back through either network to be printed at the 
transaction terminal and/or at a designated facsimile machine. 
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...SPECIFICATION create an additional record, placed after the previous 
record. This allows the reconstruction of the status at any point in 
time, and provides a complete audit trail of all entries. 

Data is entered at any terminal 1 on any node of the central system 
network and is then asynchronously replicated to all other nodes by use 

...that node. Should a node become unavailable for any reason, the log 
entries accumulate until the node becomes available again. 

To maintain integrity of the data , modifications of database entries 
are not permitted. Changes in information are implemented by entry 
of an additional record which is linked to the longitudinal chain for 
that MEDBANK subscriber. For example, a change of address... 
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Claims 

Fulltext Word Count: 3762 
English Abstract 

A system for protecting copyrighted materials which are digitally 
transferred. A terminal (14) is wirelessly connected to a server (12), 
digital rights management engine (18) and content storage device (16) . 
After the user is authenticated, the server gains authorization to 
forward the content to the user. By having almost all functions in the 
secure area of the server, illegal copying is less likely to occur. 

French Abstract 

La presente invention concerne un systeme permettant de proteger des 
objets couverts par un droit d'auteur transferes numeriquement . Selon le 
systeme de l f invention, un terminal (14) est relie sans fil a un serveur 
(12), a un moteur de gestion de droits numeriques (18) et a un dispositif 
de stockage de contenus (16). Apres que 1 ' ut ilisateur a ete authentifie, 
le serveur obtient 1 ' autorisation de transmettre le contenu a 
1 ' utilisateur . Presque toutes les fonctions etant rassemblees dans la 
zone securisee du serveur, il est moins probable que puisse se produire 
une copie illegale. 
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Detailed Description 

. . . itself comprise data on the requesting user, identification data of 
the user's device, data relating to requesting time, and data relating to 
the requested content . The data in the audit trail storage may not 

be modified . The information as stored therein may be used e.g. to 
make charges where appropriate to the user. At the same time, the 
4 

requested data is... 
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... different Corporations. Agent can also 
help the Plan sponsor in Plan creation and 
implementation process. 

Auditor The user can view any plan, product or 
marketing information in the system. 

Auditor is not privileged to modify any part 

of: i" he system. 

Channel Partner The user can market and sell Company 
services 

Content Creator The user can post 
marketing/ communications content for... 
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Claims 
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English Abstract 

A system (102) and method for tracking audits of employees is provided. 
In a simplified embodiment, the system utilizes a memory (106) and a 
processor (112) programmed by software stored within the memory. The 
processor is programmed to perform the steps of: requesting a user of the 
system to specify a number of employed entities to be audited; requesting 
the user of the system to specify a number of queries to be provided for 
auditing the employed entities; selecting the specified number of 
employed entities; requesting the user of the system to provide a job 
code (182) for each of the selected employed entities to further define 
the queries that are selected for auditing each of the selected employed 
entities; and, selecting the specified number of queries for each of the 
selected employed entities. 

French Abstract 

La presente invention concerne un systeme et un precede permettant 
d'effectuer le suivi de la verification d'employes. Dans un mode de 
realisation simplifie, le systeme utilise une memoire et un processeur 
programme par un logiciel au sein de la memoire. Le processeur est 
programme pour effectuer des etapes suivantes : requete aupres d'un 
utilisateur du systeme de preciser un nombre d'entites utilisees a etre 
verifiees ; requete aupres de 1 1 utilisateur du systeme de preciser un 
nombre d 1 interrogations a fournir pour la verification des entites 
utilisees; selection du nombre specif ie d' entites utilisees; requete 
aupres de 1 1 utilisateur du systeme de fournir une code tache pour chacune 
des entites utilisees choisies afin de definir davantage les 
interrogations qui sont choisies pour la verification de chacune des 
entites utilisees; et, la selection d'un nombre determine 
d 1 interrogations pour chacune des entites utilisees choisies. 
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so that the employe^Jay use the present auditing s^^rn 102 (FIG. 1) 
for viewing finalized and computer inputted audit reports, editing the 
computer inputted audit reports, entering results from audits , 
and/or performing audits on employees. Low level security access does 
not allow editing of data stored within tables 120, 140, 160, 180 of 
the nonvolatile storage device 118 (FIG. 1). 

The security level for a manager that utilizes the auditing... 

.102 (FIG. 1) may be set to high, thereby allowing the manager to enter, 
edit and/or manipulate data and reports via use of the auditing system 
1.02 (FIG. 1). Editing, data manipulation, and 
7 

reports are further discussed in detail below. It should be noted that 
auditing functions made available for each separate level of security 
may differ and be changed by a user having the highest security level. 

An employee number ... access allows the user to utilize the present 
auditing system 102 (FIG. 1) for viewing finalized and computer inputted 
audit reports, editing the computer inputted audit reports, entering 
results from completed aud its performed via use of observation 
sheets, and performing audits . Observation sheets are forms that are 
created and used by the auditing system 102 (FIG. 1) to perform random 
employee auditing. Further discussion of the production and use of 
observation sheets is 1 5 provided in detail below. Low level security 
access does not allow editing of data stored within tables 120, 
140, 160, 180 of the nonvolatile storage device 118 (FIG. 1). 

If the user identification and password are valid... 
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English Abstract 

A system, method and computer program product (100) are disclosed for 
collaborative forecasting utilizing a supply chain management framework. 
A global forecast is identified for a plurality of outlets of a supply 
chain and then stored in memory. The global forecast (4400) is 
subsequently transmitted to each of the outlets utilizing a network. 
Feedback relating to the global forecast is received from the outlets 
utilizing the network and stored in memory. The global forecast is then 
altered based on the feedback and the supply chain is managed utilizing 
the altered global forecast. Many other embodiments and aspects are 
disclosed and claimed. 



French Abstract 

L' invention concerne un systeme, un procede et un produit programme 
inf ormatique (100) concus pour des previsions collaboratives au moyen 
d ' un cadre de gestion de chaine d ' approvisionnement . Une prevision 
globale est identifiee pour une pluralite de points de vente d'une chaine 
d ' approvisionnement puis est stockee en memoire. La prevision globale est 
ensuite transmise a chacun des points vente par le biais d'un reseau 
(4400). Une retroaction relative a la prevision globale est recue des 
points de vente au moyen du reseau puis est stockee en memoire. La 
prevision globale est alors modifiee en fonction de la retroaction et la 
chaine d ' approvisionnement est geree a l'aide de la prevision globale 
modifiee. Plusieurs autres modes de realisation et aspects sont exposes 
et revendiques . 
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. . . been compromised, the file system is usually the first thing to go-and 
an intruder could easily cover up traces of the intrusion. 



5 Collecting audit data on a write-once device is slightly more 
effort to configure than a simple file, but it has the significant 
advantage of greatly increased security because an intruder could not 
alter the data showing that an intrusion has occurred. The 
disadvantage of this method is the need to maintain a supply of storage 
media and the cost of be optimized against security breaches. Keeping 
this audit collection process in-house would require effort to secure the 
various options for maintaining audit data integrity, detailed further 
in the following sub-section. 

Preserving Audit Data 

Audit data should be some of the most carefully secured data at the 
site and in the backups. If an intruder were to gain access to audit 
logs, the systems themselves, in addition to the data would be at risk. 

Audit data may also become useful to the investigation, apprehension, 
and prosecution of the perpetrator of an incident. If a data handling 
plan is not adequately defined. . . 

.in the aftermath of an event, and it may 1 5 create liability resulting 
from improper treatment of the data. 

Legal Considerations 

Due to the content of audit data , there are a number of legal 
questions that arise which might need to be addressed by legal counsel. 
As the Supply Chain management system collects and saves audit data , 
it needs to be prepared for consequences resulting both from its 
existence and its content. 

One area concerns the privacy of individuals. In certain instances, 
audit data may contain personal information . Searching through the 
data, even for a routine check of the system's security, could represent 
an invasion of privacy. The privacy policy outlined in. . . 
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English Abstract 

The invention is an improvement to previous data acquisition systems in 
which log sheets are used to record events such as faults with machinery. 
The invention provides a system which allows a potential furture 
occurrence to be defined rapidly and very easily. The system thereafter 
allows the actual occurence of such events to be recorded as they happen. 
The event definition can be constantly updated so that more information 
on the nature of the event can be obtained as time progresses. The system 
therefore allows the impact of potential problems to be assessed quickly 
and at low cost. The system can also be used to diagnose problems and 
provide real time feedback about the occurrence of events. A preferable 
embodiment of the system comprises an input means attached to a 
controller, the controller comprising an event definer connected to an 
input means configurer. The controller is fruther connected to a database 
for storing data about the occurence of events. 



French Abstract 

L' invention concerne un systeme d ' acquisition de donnees ameliore faisant 
intervenir des feuilles de controle pour 1 ' enregistrement d'evenements 
tels que des pannes machines. Le systeme selon 1' invention permet de 
definir rapidement et simplement un evenement potentiel futur, et 
d ' enregistrer de tels evenements lorsqu'ils surviennent. La definition 
d' evenement peut etre actualisee en continu de maniere a obtenir plus 
d ' informations sur la nature de 1' evenement avec le temps. Le systeme 
selon 1' invention permet par ailleurs d'evaluer rapidement et a moindres 
couts 1 ' impact de problemes potentiels. Ledit systeme peut egalement etre 
employe pour diagnostiquer des problemes et fournir une retroaction en 
temps reel concernant la survenue des evenements. Dans un mode de 
realisation prefere, le systeme selon 1' invention comporte un moyen de 
saisie relie a un controleur, le controleur comportant quant a lui un 
definiteur d ' evenement connecte a un conf igurateur de moyen de saisie. 
Ledit controleur est par ailleurs connecte a une base de donnees destinee 
a enregistrer des donnees concernant la survenue des evenements. 
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Detailed Description 

... stoppage. When a parameter is changed, all the results for all time 
are affected and the result history is updated retrospectively. 
However, the actual event log is not changed since this is the 
primary source of data. 

It is only the results presented to the user that change when a parameter 
is changed. 



This . . . 



.and can have the immediate effect on all of the results. 



Thus, the present invention can reconstruct an historical trail from a 
minimum of key data , ie. From an audit log containing only the event 
ID and a timestamp. The system can redefine the profile of an event and 
reconstruct a fully populated history table... 



11/5, K/27 (Item 21 from file: 349) 

DIALOG (R) File 34 9:PCT FULLTEXT 

(c) 2003 WIPO/Univentio . All rts. reserv. 

00740783 **Image available** 
AUTOMATED DATA INTEGRITY AUDITING SYSTEM 

SYSTEME AUTOMAT I SE DE VERIFICATION DE L ' INTEGRITE DE DONNE ES 

Patent Applicant /Assignee : 

LTCQ INC, 135 South Road, Bedford, MA 01730, US, US (Residence), US 
(Nationality) 
Inventor (s) : 

FOGEL Barry S, 15 Homestead Street, Waban, MA 02468, US, 
KAZMER A James, 23 Lincoln Circle West, Andover, MA 01810, US, 
LITTLEHALE Steven B, 30 Beaufort Road, Jamaica Plain, MA 02130, US, 
Legal Representative: 

LIPSITZ Barry R (agent), 755 Main Street, Building No. 8, Monroe, CT 
06468, US, 

Patent and Priority Information (Country, Number, Date) : 

Patent: WO 200054123 A2-A3 20000914 (WO 0054123) 

Application: WO 2000US6204 20000309 (PCT/WO US0006204) 

Priority Application: US 99123736 19990310 

Designated States: AE AL AM AT AU AZ BA BB BG BR BY CA CH CN CR CU CZ DE DK 
DM DZ EE ES FI GB GD GE GH GM HR HU ID IL IN IS JP KE KG KP KR KZ LC LK 
LR LS LT LU LV MA MD MG MK MN MW MX NO NZ PL PT RO RU SD SE SG SI SK SL 
TJ TM TR TT TZ UA UG UZ VN YU ZA ZW 

(EP) AT BE CH CY DE DK ES FI FR GB GR IE IT LU MC NL PT SE 

(OA) BF BJ CF CG CI CM GA GN GW ML MR NE SN TD TG 

(AP) GH GM KE LS MW SD SL SZ TZ UG ZW 

(EA) AM AZ BY KG KZ MD RU TJ TM 
Main International Patent Class: G06F-017/30 
Publication Language: English 
Filing Language: English 
Fulltext Availability: 

Detailed Description 

Claims 

Fulltext Word Count: 16534 
English Abstract 

An automated computer-based data integrity auditing system is provided 
for use in the healthcare industry, financial industry, academic and 
educational fields, or any other field in which a need exists for 
monitoring data integrity. Coded data (16) received from a service 
organization (10, 12) are checked for proper coding and completeness 
(66). The coded data (16) are stored in a computer database (58) together 
with indicators specifying bad data found during the checking step (66). 
The stored coded data are processed in a computer to apply at least one 
data integrity test (42, 44) to a portion of the data. A score (24) is 
assigned to the tested portion of data based on the data integrity test. 
Reports (22, 52) are generated by the computer to identify the score 
together with suggestions for resolving any data integrity and/or coding 
and completeness problems determined by the system. Real-time reports 
(38) can also be provided to the organization to assist in coding and 
entering the data prior to a formal submission to a government agency or 
the like. 

French Abstract 

L* invention concerne un systeme automatise de verification de 1 ' integrite 
de donnees par ordinateur, destine a s'utiliser dans le domaine de la 
sante, dans le domaine financier, dans le domaine academique et dans 
celui de I 1 education, ou dans tout autre domaine dans lequel il est 
necessaire de controler 1' integrite des donnees. On verifie le codage 



adequat et 1 1 integrali^B( 66 ) 

organisme de services . Tes do 
base de donnees (58) d'ordina 
designant les donnees defectu 
verification. On effectue un 
dans un ordinateur pour proce 
de donnees sur une partie des 
partie des donnees soumise a 
de donnees. Des rapports (22, 
note et font des suggestions 
systeme et lie a 1 ' integrite 
1 ' integralite . Des rapports { 
1' organisme de coder et d'ent 
agence gouvernementale ou ana 



de donnees (16) codees pr^Biant d'un 
nnees (16) codees sont memorisees dans une 
teur con j ointement avec des indicateurs 
euses trouvees lors de la phase (66) de 
traitement des donnees codees memorisees 
der a au moins un essai (42, 44) d 1 integrite 

donnees. On attribue une note (24) a la 
1'essai sur la base de l'essai d'integrite 
52) generes par 1' ordinateur indiquent la 
pour resoudre tout probleme determine par le 
des donnees et/ou au codage et a 
38) en temps reel permettent egalement a 
rer les donnees avant de les soumettre a une 
logue . 
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reimbursement usually would 
be higher, as well. 

If there is more than one data integrity issue 
involving RUGS items, the process requires iteration. 

That is, Data Integrity Audit tests are given in a 
standard order. After each test, the MDS is modified 
if necessary to eliminate any data integrity issue. 

This is continued through the entire list of data 
integrity tests. Then, the tests are applied again, 
to verify that new data integrity issues were not 
created by the changes just made. This process is 
repeated if necessary. 

For example, an original MDS assessment, 
assessment A, determines the baseline RUGS group 
this we call Ab . . . 
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English Abstract 

A method for associating data with documents that aid in the subsequent 
auditing of those documents. The invention in one embodiment further 
provides methods for auditing the documents. The associated data 
includes information for verifying the document's authorship, as well as 
for verifying that the document has not been altered . The 
associated data may further include information for verifying the 
document's existence at a certain time. By associating verifiable 
authorship data, the invention provides methods for retrieval of all of a 
specific author's documents from a collection of documents. 

French Abstract 

L' invention concerne un procede relatif a 1 ' association de donnees et de 
documents facilitant ensuite 1' execution d'un controle des documents en 
question. Selon une variante, 1 * invention concerne des procedes relatif s 
au controle des documents. Les donnees associees comportent des elements 
d ' information qui permettent de verifier la paternite de tel ou tel 
document, et de verifier aussi que le document n'a pas ete modifie. Ces 
donnees associees peuvent egalement comporter des elements d 1 information 
permettant de verifier 1' existence de tel ou tel document a un moment 
donne. L' invention concerne enfin des procedes qui, par 1 ' association de 
certaines donnees de paternite verifiables a des documents, permettent 
d'extraire les documents d'un auteur specif ique dans une serie de 
documents . 

Fulltext Availability: 
Detailed Description 

English Abstract 

A method for associating data with documents that aid in the subsequent 
auditing of those documents. The invention in one embodiment further 
provides methods for auditing the documents. The associated data 
includes information for verifying the document's authorship, as well as 
for verifying that the document has not been altered . The 
associated data may further include information for verifying the 
document's existence at a certain time. By associating verifiable 
authorship data, the invention provides methods for retrieval... 

Detailed Description 

. . . 18 then uses his private key 52 to io encrypt a copy of the submitted 
information and appends this encrypted copy 56 to the submitted 
information , thus forming a Verifiable Audit Record 22. 

FIGURE 7 depicts the steps involved in auditing this sort of Verifiable 
Audit Record 22. 

As in the previous examples, the Auditor 14... 

...in turn. As in the previous examples 1 5 the Auditor 14 uses the 

Notary's public key 54 to verify that the Verifiable Audit Record 22 
has not been modified since submission. The Auditor 14 then uses the 
Author's public key 44 to verify that the Message Digest 70 belongs to 
the Author 10. . . 



ZW AM 
MC NL 



KZ LC 
SK SL 
AZ BY 
PT SE 



LK LR 
TJ TM 
KG KZ 
BF BJ 



14. In these methods, because the Verifiable Audit Records 22 are kept 



where they can be view^^knd recorded by others, the 2o^M:ary 18 cannot 
alter these record^^without risking subsequent dete^Ron. 

In another method for ensuring that Verifiable Audit Records 22 have 
not been modified subsequent to their submission to a Notary 18, the 
Verifiable Audit Records 22 include Audit Record Verification 
Information 56. Such information may include a Notary's digital 
signature . 

Such information may also be based upon one or more previously submitted 
Verifiable Audit Records 22. In yet another method for ensuring that 
Verifiable Audit Records 22 have not been modified subsequent to 
their submission to a Notary 1 8, an Author 10 submits the same 
information to several different Notaries 18. If the Verifiable Audit... 

...For the purposes of this invention, the receipt will be referred to as a 
Notary's - loCertif icate . In one method, the Notary's Certificate 
includes Audit Record Verification Information 56. 

Example . 

The following example is intended to illustrate an application of the 
invention in the context of an Internet content-provider. The example is 
...a given time period was reported. Since the notary never knows which 
response will be investigated, there is always deterrence for an 
incomplete response. 

The auditor randomly records some of the data stored on the web page, 
checking later to see that this data has not been altered . The 
auditor also periodically examines the data that is not on public 
display {which includes author identification information) to insure that 
if you apply the appropriate one-way hash, it does yield. . . 
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English Abstract 

A computer-based system providing for the electronic approval of 
documents in parallel. An electronic document is issued for approval by a 
user at one point in time at some location. It can subsequently be 
accessed by other users, who can then electronically approve the 
documents simultaneously or serially. The technology alerts users to any 
unauthorized modifications which may have been made to the document 



during subsequent appr^M-S. A document authentication (DAC 0) is 

generated, linked to th^r original document. Subsequent approvals of the 
document generate a DAC x related to that specific approval as well as 
approval information such as an individual's handwritten signature as 
well as any other identifying information (Name, date and time of 
signing, biometrics, voice, fingerprint, picture, etc..) which may be 
required for the approval process. If the DAC generated for each 
subsequent approval matches the DAC 0, the approval is validated, 
optionally encrypted and stored in an Approval Data Packet (ADP) along 
with the approval information. A match in the DACs also confirms that 
users are working from the same document and that the data has not been 
changed in the interim {i.e. all users are approving the same document). 
Should the DACs not match, corrective action may be necessary. The data 
scored in the EADPs may be incorporated into the original document. 

French Abstract 

L' invention porte sur un systeme informatise assurant 1 ' homologation 
electronique de documents en paral.lele. Un document electronique est emis 
pour homologation par un utilisateur a un moment donne et a un certain 
emplacement. D'autres ut ilisateurs , pouvant ensuite y avoir acces, 
peuvent alors homologuer electroniquement les documents simultanement ou 
en serie. Le systeme avertit les utilisateurs de certaines modifications 
non autorisees qui peuvent avoir ete faites sur le document lors 
d' homologations ulterieures . Un code d ' authent if ication de document (DAC 
0) est genere, lie au document original. Les homologations ulterieures 
des documents generent un DAC x par rapport a cette homologation 
specifique ainsi que des informations sur les homologations telles que 
signatures manuscrites d'individus et toute autre information 
d ' identification (nom, date et heure de la signature, biometrie, voix, 
empreinte, photo, etc..) qui peuvent etre requises pour le processus 
d ' homologation. Si le DAC genere pour chaque homologation ulterieure 
correspond au DAC 0, 1 ' homologation est validee, eventuellement codee et 
stockee dans un paquet de donnees d ' homologation (ADP) avec les 
informations sur les homologations. Une mise en correspondance des DAC 
confirme que les utilisateurs travaillent a partir du meme document et 
que les donnees n ' ont pas ete modifiees dans 1 * interim (c-a-d. que tous 
les utilisateurs homologuent le meme document) . Si les DAC ne 
correspondent pas, une action correctrice peut etre necessaire. Les 
donnees stockees dans les EADP peuvent etre introduites dans le document 
d ' origine . 

Fulltext Availability: 
Detailed Description 

Detailed Description 

they are all approving the same 
unmodified document. In such cases, each approval will generate a DAC on 
the document being approved along with additional information such as 
1 5 audit information , (i.e. date and time of signing, name of 
signer) and handwritten signature, or other identifying items such as 
voice and fingerprints, 
photograph or biometrie . . 

...compared to the DAC generated by the user. If they match, this will 
confirm 

that every user approving the document is actually approving the same 

information and that the data has not been changed between 
approvals by 
the different users. 



